WooCommerce Wholesale Lead Capture Plugin Exploited in File Upload Attacks

A vulnerability in the WooCommerce Wholesale Lead Capture plugin allowed unauthenticated file uploads, resulting in widespread exploitation attempts before and after a patch was issued in February 2026.

The security flaw, tracked as CVE-2026-27540, was present in all plugin versions up to and including 2.0.3.1. The issue was addressed with the release of version 2.0.3.2 on February 20, 2026. The plugin, which is used on approximately 6,000 active sites, is a premium extension for WooCommerce.

Wordfence, a security provider, stated that its firewall blocked more than 100,000 attempts to exploit this vulnerability. These attacks targeted the plugin’s AJAX handler, which improperly accepted file extension parameters from user requests, allowing attackers to upload executable PHP files without authentication.

Exploit activity was concentrated in three main periods: June 4-17, July 1, and August 30, 2026. During these waves, attackers attempted to upload webshells, commonly named shell.php, that could be used to further compromise affected sites.

What the numbers show

• Over 100,000 exploitation attempts were recorded by Wordfence.
• Three attack waves occurred: June 4-17, July 1, and August 30, 2026.
• The plugin had about 6,000 active installations at the time.
• Patch for the vulnerability was released on February 20, 2026.

The vulnerability stemmed from the plugin’s file upload handler, which allowed attackers to modify the list of permitted file types. By injecting 'php' into the allowlist, attackers could upload malicious code directly to the server. Sites that had not updated to version 2.0.3.2 or later remained at risk throughout the exploitation period.

Wordfence responded by distributing a virtual-patch firewall rule to its Premium, Care, and Response customers on February 27, 2026. The same protection was made available to free-tier users on March 29, 2026, aiming to reduce the risk for unpatched sites.

According to Wordfence, the exploit payloads typically included a PHP webshell that reported host information and provided a browser-based interface for uploading additional files. This allowed attackers to maintain access and potentially escalate their activities on compromised sites.

Wordfence advised site administrators to upgrade to version 2.0.3.2 or newer, inspect upload directories for unexpected PHP files, and review access logs for suspicious requests to admin-ajax.php using the vulnerable action. These steps were recommended to help identify and remediate any unauthorized access resulting from the vulnerability.

* This article is based on publicly available information at the time of writing.