WooCommerce lead-capture flaw enables unauthenticated PHP uploads
Attackers are actively exploiting CVE-2026-27540, a critical vulnerability in the premium WooCommerce Wholesale Lead Capture WordPress plugin. Wordfence said it has blocked more than 100,000 exploit attempts since June 2026, including 99 attempts in the preceding 24 hours. The plugin has more than 6,000 active installations.
The vulnerability carries a CVSS score of 9.8 and affects every WooCommerce Wholesale Lead Capture version up to and including 2.0.3.1. It allows an unauthenticated attacker to upload arbitrary files, including PHP backdoors, creating a path to remote code execution on an affected server.
Missing validation exposes the upload handler
The flaw stems from missing file-type validation in an AJAX action called wwlc_file_upload_handler. An attacker does not need an account to send a crafted request to the endpoint and attempt to place a file on the target site.
In activity observed by Wordfence, attackers submitted requests to that action with a forged file_settings parameter and a malicious PHP file named shell.php. The uploaded web shell reports host details and includes a browser-based upload form that can be used to write further malicious files to the compromised WordPress installation.
Wordfence identified exploit attempts from several IP addresses, including 92.241.13.213, 31.59.129.150, 23.137.105.214 and 104.194.9.138. Those indicators can help defenders prioritise log review, but the core exposure is the unauthenticated upload action itself.
What administrators should examine
Site owners should determine whether WooCommerce Wholesale Lead Capture is installed and whether the version is within the affected range. They should check for unexpected or recently created .php files, particularly in upload directories, where PHP files are unusual and may indicate that an upload attempt succeeded.
Administrators should also review requests to /wp-admin/admin-ajax.php for an action parameter set to wwlc_file_upload_handler. Examining those requests alongside the reported source IP addresses can help identify attempted exploitation and guide incident investigation.
Separate critical issues affect The Events Calendar
Wordfence also described two critical vulnerabilities in The Events Calendar, a WordPress plugin installed on more than 600,000 websites. CVE-2026-78159 affects versions through 6.17.3, while CVE-2026-78006 affects versions through 6.17.4; both have CVSS scores of 9.8.
Exploitation of those issues requires comments to be enabled on the target event page and the plugin setting to show comments on event pages to be active. Wordfence said the chains begin in the widget-rendering pipeline and can lead to unauthenticated remote code execution through different methods.
StellarWP addressed the flaws in versions 6.17.3.1 and 6.17.4.1, respectively. For businesses operating WordPress sites, the immediate implication is to inventory these plugins, move to the stated fixed releases where applicable, and treat unexplained PHP files or relevant AJAX requests as potential incident evidence.