A critical security flaw in the WooCommerce Wholesale Lead Capture plugin is being actively exploited, allowing remote attackers to upload malicious files and potentially take full control of vulnerable WordPress sites.
The vulnerability, tracked as CVE-2026-27540, affects WooCommerce Wholesale Lead Capture versions 2.0.3.1 and earlier.
The premium plugin, used by an estimated 6,000 websites, helps store owners build wholesale-registration forms and supports file uploads as part of the registration process.
Security researchers publicly disclosed the issue on February 20, 2026. It received a CVSS severity score of 9.8 out of 10, placing it in the critical category.
The vendor has addressed the flaw in version 2.0.3.2, and users are strongly advised to update immediately. According to Wordfence, its firewall has already blocked more than 100,000 exploitation attempts.
Attackers have reportedly targeted the weakness for months, with heightened activity observed between June 4 and June 17, as well as on July 1 and August 30.
WooCommerce Flaw Enables Site Takeover
The issue is an unauthenticated arbitrary file-upload vulnerability. This means an attacker does not need a WordPress account or administrator access to attempt exploitation.
WooCommerce Wholesale Lead Capture includes an AJAX upload handler called wwlc_file_upload_handler.
The handler is intended to accept only approved file formats from visitors submitting wholesale-registration forms. However, the plugin reads the allowed file-type list from data supplied in the incoming request.
Because attackers control that request data, they can alter the list of permitted extensions and include PHP files. The upload process also disables a standard file-type validation check, increasing the risk that a dangerous server-side file can be accepted.
A successful attacker could upload a PHP webshell, a malicious script that can be accessed through a browser.
Such a backdoor may allow the attacker to run commands on the server, add unauthorized administrator accounts, steal website data, modify pages, install additional malware, or take over the entire WordPress installation.
The observed attack activity included attempts to upload files named shell.php. While this filename is a useful warning sign, site owners should not rely on it alone because attackers can choose any file name.
Wordfence added the flaw to its vulnerability database on February 25, 2026. Customers using Wordfence Premium, Care, and Response received firewall protection on February 27. Free Wordfence users received the rule on March 29.
Firewall protection can block known attack attempts, but it is not a replacement for patching. Administrators should update WooCommerce Wholesale Lead Capture to version 2.0.3.2 or later as soon as possible.
Site owners should also inspect their WordPress uploads directory and other web-accessible folders for unexpected or recently created .php files.
Web-server logs should be reviewed for requests to /wp-admin/admin-ajax.php containing the action wwlc_file_upload_handler.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
