WooCommerce Wholesale Lead Capture Flaw Used to Plant Web Shells

Attackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin, a paid WordPress add-on with more than 6,000 active installations, to plant web shells on compromised websites. Wordfence, a WordPress security company, said the flaw lets unauthenticated attackers upload arbitrary files, including PHP backdoors, and achieve remote code execution. In plain terms, someone who has not logged in can place a hidden program on a site's server and then run their own commands on that server. The company said it has blocked more than 100,000 exploit attempts targeting this vulnerability since June 2026, with 99 of those attempts recorded in the past 24 hours. The issue is tracked as CVE-2026-27540 and carries a CVSS severity score of 9.8 out of 10, which is considered critical.

The vulnerability is an arbitrary file upload problem caused by missing file type validation in an AJAX action named wwlc_file_upload_handler. An AJAX action is a function that runs in the background when a website sends a request without reloading the whole page. The flaw affects all versions of the plugin up to and including 2.0.3.1. Because the action does not properly check what kind of file is being uploaded, an attacker who is not logged in can upload any file to the site's server. In the attack observed by Wordfence, threat actors sent crafted requests to the wwlc_file_upload_handler AJAX action with a forged file_settings parameter and a malicious PHP file named shell.php. The uploaded file is a web shell, which is a small page that reports information about the host machine and includes a browser-based upload form so the attacker can write additional malicious files onto the affected WordPress site.

Wordfence listed ten IP addresses from which attack attempts have originated: 92.241.13.213, 31.59.129.150, 2a0f:85c1:840:5389::1, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, and 37.114.144.209. The company advises WordPress site owners to check for unexpected or recently created .php files, especially in the uploads directory, and to review server logs for suspicious requests to /wp-admin/admin-ajax.php where the action parameter is set to wwlc_file_upload_handler and the request comes from one of those addresses. A .php file is a program file, and a newly appearing one can be a sign that a web shell has been planted.

In a separate but related report, Wordfence detailed two critical flaws in The Events Calendar, a WordPress plugin installed on more than 600,000 websites. These flaws require the target event page to have comments enabled and the plugin's Show comments on event pages option to be active. The first, CVE-2026-78159, has a CVSS score of 9.8 and stems from insufficient validation of the widget classes map in the parse_array function. It affects versions up to and including 6.17.3. The second, CVE-2026-78006, also rated 9.8, comes from insufficient protection in the is_safe_widget_instance function and affects versions up to and including 6.17.4. Both chains begin in the plugin's widget-rendering pipeline and can ultimately lead to remote code execution without authentication. The first method uses PHP Object Injection, a type of attack that tricks a website program into processing harmful data, to execute arbitrary operating system commands on the underlying server. The second method bypasses the object-injection guard and abuses an arbitrary-callable primitive to reset an administrator's password, after which an attacker can upload a malicious plugin and take complete control of the site.

Wordfence warned that both chains can be triggered through WordPress's pending-comment preview, without moderator approval. A successful attack could lead to complete site takeover, theft of sensitive data, and deployment of malware. StellarWP, the company that develops The Events Calendar, has fixed the flaws in versions 6.17.3.1 and 6.17.4.1 respectively. For website owners and hosting teams, these two reports highlight how a single vulnerable plugin can expose an entire WordPress installation. Attackers do not need valid credentials when a file upload check is missing, and a web shell gives them a foothold to move through the hosting environment. Keeping plugins updated, monitoring for unexpected files, and placing a web application firewall in front of a WordPress site remain important defenses. A managed WordPress hosting service such as AEU Hosting aims to keep the platform and its plugins secured end to end, helping to reduce the window in which such plugin flaws can be exploited.