.jpg)
Attackers have been uploading PHP webshells to WordPress sites through a critical flaw in a third-party WooCommerce plugin, four months after a fix was released.
In a technical write-up published on September 14, Wordfence said its firewall had blocked more than 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, a premium plugin from Rymera Web Co with an estimated 6000 active installations. The flaw was disclosed and patched on February 20 in version 2.0.3.2.
Wordfence rated it CVSS 9.8. The CVE record, issued by Patchstack, carried a 9.0 score, a difference that turns partly on how complex the attack is judged to be. Wordfence's data shows a single unauthenticated request.
An Allowlist the Attacker Controls
The plugin exposes an AJAX action, wwlc_file_upload_handler, that handles uploads from its wholesale registration form and is reachable by unauthenticated visitors.
That handler checks a file's extension against a list of permitted types. Wordfence found the list is read straight from the request rather than from the form's server-side configuration, so an unauthenticated attacker can include php in a list of their own and upload an executable, turning an arbitrary file upload into remote code execution.
The code compounds it by calling WordPress's upload function with type checking switched off, leaving the extension check as the only barrier.
Wordfence said attackers submitted crafted requests carrying a forged settings parameter and a PHP file, often named shell.php. The resulting webshell reports host details and serves a browser-based upload form for writing further files to the site.
Exploit attempts were heaviest between June 4 and June 17, with further activity on July 1 and August 30. All versions up to and including 2.0.3.1 are affected. Researcher Teemu Saarentaus reported the flaw.
What Site Owners Should Do
Update to 2.0.3.2 or later. A firewall rule blocks known exploit attempts but does not patch the plugin, and all versions up to 2.0.3.1 remain vulnerable underneath.
Wordfence advised reviewing the uploads directory for unexpected or recently created PHP files, and checking web server access logs for requests to admin-ajax.php carrying the vulnerable action.
Anyone finding evidence should remove unexpected files and unknown administrator accounts, and review the site for backdoors.
Wordfence added that an absence of matching log entries does not prove a site is clean.
.jpeg)
