Critical severity9.0NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026

CVE-2026-27540

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Rymera/Woocommerce Wholesale Lead Capturellm-create
Range: <=2.0.3.1
WordPress/Woocommerce Wholesale Lead Capturellm-fuzzy
Range: <=2.0.3.1

Patches

Vulnerability mechanics

References

patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerabilitynvd

News mentions

PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug
Infosecurity Magazine · Sep 16, 2026
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
The Hacker News · Sep 16, 2026
Hackers Exploit WooCommerce Plugin Bug to Take Over WordPress Sites Without Login
Cyber Security News · Sep 15, 2026
Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin
Wordfence Blog · Sep 14, 2026

cvss	0.585
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000