Critical WooCommerce plugin flaw exploited to upload backdoors

Attackers are actively exploiting a critical unauthenticated arbitrary file-upload vulnerability in the WooCommerce Wholesale Lead Capture plugin, tracked as CVE-2026-27540, to upload PHP webshells. The flaw stems from an AJAX handler that trusts a user-controlled file extension allowlist, allowing PHP files to be uploaded. Wordfence has blocked over 100,000 attacks and advises updating to version 2.0.3.2 or later, while also recommending checks for suspicious files and admin accounts.

The vulnerability resides in an unauthenticated AJAX handler that validates file extensions against a user-supplied allowlist, letting attackers append "php" to permitted types. Wordfence observed concentrated attack waves in early June, mid-July, and late August, with over 100,000 blocked attempts. The uploaded webshell performs host reconnaissance and includes a browser-based upload form for deploying further malicious files.

Administrators are urged to update to version 2.0.3.2, released in February, and to audit upload directories for unexpected PHP files, review admin-ajax.php logs for the vulnerable handler, and remove unknown administrator accounts. If compromise is suspected, restoring from a clean backup is recommended, as fully eradicating backdoors and persistence mechanisms can prove difficult.