Hackers are actively exploiting a critical vulnerability in a third-party WooCommerce plugin to upload malicious PHP files and potentially take complete control of WordPress websites.
The flaw affects WooCommerce Wholesale Lead Capture, a premium plugin used by online stores to collect and manage wholesale customer registrations.
Tracked as CVE-2026-27540, the vulnerability affects versions 2.0.3.1 and older. It was patched in version 2.0.3.2, but security researchers say attackers are still targeting websites that have not updated.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
Attackers can upload malicious files without logging in
The vulnerability is an unauthenticated arbitrary file-upload flaw.
In simple terms, an attacker does not need an administrator account or even a normal user login to attempt exploitation.
The vulnerable plugin exposes a file-upload function that can be manipulated into accepting PHP files, even though executable PHP files should normally be blocked.
Attackers can alter a user-controlled setting to add “php” to the list of allowed file extensions.
Once that happens, the plugin accepts the malicious file and stores it on the website server.
That file can then act as a webshell.
A webshell is a small malicious program that gives an attacker remote control over a website through a browser or command interface.
Webshell can become a permanent backdoor
Wordfence says attackers exploiting the flaw are uploading a file called shell.php.
The webshell can collect information about the host system and provides an upload interface that allows additional malicious files to be written to the site.
That means the first malicious file may only be the starting point.
Once the attacker has access, they can potentially upload additional malware, create hidden administrator accounts or install persistence mechanisms that allow them to return later.
This is why simply deleting one suspicious file may not always be enough after a successful compromise.
Security teams may need to examine the wider site for additional backdoors or restore it from a known-clean backup.
More than 1,00,000 attacks already blocked
The scale of exploitation shows why the vulnerability remains dangerous even though a patch has existed for months.
Wordfence says its web application firewall has blocked more than 1,00,000 attempts to exploit CVE-2026-27540.
Attack activity surged between June 4 and June 17, with additional spikes on July 1 and August 30.
That pattern suggests attackers are continuing to scan the internet for WordPress sites that still run the outdated plugin.
This is common with WordPress vulnerabilities.
Once an exploit becomes public, cybercriminals can automate scans across thousands of websites and attack any site that responds as vulnerable.
They do not necessarily need to know whether the website is valuable before trying.
Why a third-party plugin can compromise the entire website
The vulnerability is not in the core WooCommerce plugin.
That distinction is important.
WooCommerce Wholesale Lead Capture is a separate third-party extension used alongside WooCommerce.
WordPress websites often rely on many plugins for functions such as payments, forms, backups, analytics and customer management.
Each additional plugin adds more code to the site.
If even one plugin contains a serious vulnerability, attackers may be able to compromise the entire WordPress installation.
That is why a website can be fully updated at the WordPress core level and still remain vulnerable because one extension has not been patched.
Website owners should check more than the plugin version
Administrators should first update WooCommerce Wholesale Lead Capture to version 2.0.3.2 or later.
But if the vulnerable version was exposed for months, updating alone may not be enough.
Wordfence recommends checking website upload directories for unexpected or recently created PHP files.
Administrators should also review logs for suspicious requests to the WordPress admin AJAX endpoint involving the vulnerable upload handler.
Unknown administrator accounts should also be treated as a warning sign.
If compromise is confirmed, security teams may need to restore the site from a known-safe backup because attackers may have installed several persistence mechanisms.
E-commerce sites make attractive targets
WooCommerce stores are particularly valuable to attackers because they may process customer information, order records and payment-related data.
A compromised online store can be used for more than simple website defacement.
Attackers may inject malicious scripts, redirect visitors, distribute malware or attempt to steal customer data.
They can also use the compromised domain to host phishing pages because legitimate business websites often carry stronger reputation than newly created malicious domains.
That makes plugin vulnerabilities an attractive way to turn a trusted e-commerce site into infrastructure for further attacks.
What this means for you: If you manage a WordPress store using WooCommerce Wholesale Lead Capture, update it to version 2.0.3.2 or newer immediately and check the site for unexpected PHP files or administrator accounts. If you are a customer, the vulnerability does not mean every WooCommerce store is compromised, but store operators running outdated third-party plugins face a real risk.
The420 Insight: The important lesson is that attackers did not need to break WooCommerce itself. One vulnerable add-on was enough. For WordPress businesses, security is only as strong as the least-maintained plugin installed on the site.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
