Attackers Exploit Critical WooCommerce Plugin Flaw to Deploy Webshells

Attackers are leveraging a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin to upload PHP webshells to WordPress websites. Security firm Wordfence has recorded more than 100,000 exploitation attempts against the flaw, identified as CVE-2026-27540.

The vulnerability affects the premium plugin developed by Rymera Web Co, which has approximately 6,000 active installations. The exploit allows unauthenticated attackers to achieve remote code execution (RCE) on affected systems.

The flaw exists within the wwlc_file_upload_handler AJAX action, which manages file uploads for the plugin’s wholesale registration form. While the handler is intended to verify file extensions against a permitted list, researchers discovered that the list is read directly from the user’s request rather than being pulled from a secure server-side configuration. This enables an attacker to include “php” in the list of permitted types within their own request.

The risk is compounded by the plugin calling the WordPress upload function with type checking disabled, leaving the manipulated extension check as the only barrier. By submitting crafted requests with forged settings parameters, attackers can upload executable files, frequently named shell.php. These webshells can then report host details and provide a browser-based interface for writing further files to the website.

Severity ratings for the vulnerability vary between security providers. Wordfence assigned a CVSS score of 9.8, while the CVE record issued by Patchstack carries a score of 9.0.

Although a patch was released on 20 February 2026 in version 2.0.3.2, exploitation activity has continued throughout the year, with notable spikes in activity between June and August. All versions of the plugin up to and including 2.0.3.1 remain vulnerable.

Site administrators must update to version 2.0.3.2 or later immediately. Wordfence advises users to review their upload directories for unexpected or recently created PHP files and to check web server access logs for suspicious requests to admin-ajax.php that carry the vulnerable action.

Anyone finding evidence of a compromise should remove unauthorised files and any unknown administrator accounts, followed by a comprehensive review of the site to identify potential backdoors.