Critical WooCommerce Plugin Flaw Exploited to Upload PHP Webshells

The plugin is called Wholesale Lead Capture Plugin for WooCommerce. It adds a dedicated registration and onboarding system for wholesale and B2B customers, letting businesses collect company and other custom information, review applications, assign wholesale user roles, and automate registration and onboarding emails. It is a premium plugin that costs between $99 and $600 and, according to its WordPress store page, has more than 20,000 active installations.

The vulnerability is an unauthenticated arbitrary file-upload flaw. As the name suggests, it allows unauthenticated parties to upload arbitrary files, including PHP webshells and executable code that can result in full site takeover. It is tracked as CVE-2026-27540 and carries a severity score of 9.0 out of 10, rated critical. Versions 2.0.3.1 and older were said to be affected. Version 2.0.3.2, released on February 20, was said to address the bug, meaning the patch has been available for almost half a year.

Defiant said its Wordfence web application firewall blocked more than 100,000 attacks. Wordfence added that it observed two attack spikes, one between June 4 and 17, and another between July 1 and August 30.

In these incidents, the attackers were mostly uploading reconnaissance webshells, possibly mapping out the landscape before deploying more serious malware. Researchers said the uploaded shell.php is a PHP webshell that reports host details and provides a browser-based upload form for writing additional malicious files to the site.

If a site is running the plugin, administrators are advised to update it to the newest version as soon as possible and to check upload directories for unexpected or recently created PHP files.