WooCommerce Wholesale Lead Capture: webshells uploaded seven months post-patch

If you have installed the premium Wholesale Lead Capture plugin for WooCommerce on a WordPress shop, today 15 October 2026 is a good day to check the version. Not because a new vulnerability has emerged, but because an old one continues to be actively exploited, seven months after the vendor patched it.

The CVE and patched version

The vulnerability is registered as CVE-2026-27540, classified as unrestricted file upload (CWE-434). According to the technical bulletin from Wordfence, reproduced by Infosecurity Magazine, Wordfence blocked over 100,000 exploitation attempts against CVE-2026-27540 in the WooCommerce Wholesale Lead Capture plugin, a premium product by Rymera Web Co with approximately 6,000 active installations. The flaw was disclosed and patched on 20 February with version 2.0.3.2.

One detail worth noting for those managing multiple installations: Wordfence rated the CVSS at 9.8, whereas the CVE record, issued by Patchstack, reported a score of 9.0—a difference that partly depends on how complex the attack is judged to be. In practice, for those needing to update, it makes little difference: the secure version remains 2.0.3.2 or later.

How the bypass works

The problem lies in the AJAX action that handles attachments from the wholesale registration form. The plugin exposes an AJAX action, wwlc_file_upload_handler, which processes uploads from the wholesale registration form and is reachable by unauthenticated visitors. That handler checks a file's extension against a list of permitted file types. Here's the error: Wordfence discovered that the list is read directly from the request rather than from the server-side configuration of the form, so it only takes forging the parameter to include php among the allowed formats.

In the requests observed by the Wordfence lab, attackers sent custom-crafted requests with a forged settings parameter and a PHP file, often named shell.php. The resulting webshell reports host details and offers a browser-based upload form to write additional files to the site.

The activity is not a single isolated spike: exploitation attempts were most intense between 4 and 17 June, with further activity on 1 July and 30 August.

How to check if you've been compromised

First: verify the installed version from Plugins > Installed Plugins in the WordPress dashboard. If it's 2.0.3.1 or earlier, update immediately to 2.0.3.2 or later.

Then look for signs of compromise. Wordfence recommends reviewing the uploads folder for unexpected or recently created PHP files, and checking your web server access logs for requests to admin-ajax.php with the vulnerable action. From the command line, on Linux hosting, a quick check is:

find /path/to/wp-content/uploads -name "*.php" -newermt "2026-06-01"
grep "wwlc_file_upload_handler" /var/log/apache2/access.log*

Be aware, however: the absence of matching log entries does not prove that a site is clean. If you find anything, the recommended procedure is to remove unexpected files and unknown administrator accounts, and scan the site for backdoors.

An operational detail for those managing many sites on shared hosting platforms: according to Hashe Computer Solutions, the Wordfence firewall rule arrived at different times depending on the plan: Wordfence Premium, Care and Response users received protection on 27 February 2026, whilst those using the free version received it only on 29 March 2026, a month later. Those managing free-licence installations who have not yet manually updated the plugin had a longer exposure window.