Critical File Upload Vulnerability in WooCommerce Wholesale Lead Capture Plugin Actively Exploited

A critical vulnerability, identified as CVE-2026-27540, has been publicly disclosed in the WooCommerce Wholesale Lead Capture plugin for WordPress. This flaw, present in versions up to and including 2.0.3.1, allows unauthenticated attackers to upload arbitrary files to a vulnerable server. The potential consequences are severe, ranging from the deployment of PHP backdoors to achieving full remote code execution (RCE) on the affected website.

Wordfence, a prominent cybersecurity firm, has been actively monitoring and blocking exploit attempts targeting this vulnerability. Since its addition to the Wordfence Intelligence database on February 25th, 2026, the Wordfence Firewall has detected and blocked over 100,000 malicious requests aimed at exploiting this flaw. This high volume of activity underscores the immediate threat posed by this vulnerability.

The vulnerability stems from a critical flaw in how the plugin handles file uploads. Specifically, the wwlc_file_upload_handler AJAX action, which is accessible to unauthenticated visitors, fails to properly validate file types. While the code includes a check against allowed_file_types, this list is dynamically read from the attacker-controlled file_settings parameter in the request, rather than being a securely configured server-side setting. This allows an attacker to simply include 'php' in their list of allowed file types, bypassing the intended security measure.

Once the file type validation is bypassed, attackers can upload a malicious PHP file, such as a webshell. This webshell can then be used to execute arbitrary commands on the server. The implications of such an attack are far-reaching, enabling threat actors to create new administrator accounts, exfiltrate sensitive data, deface websites, or gain complete control over the compromised WordPress installation.

Wordfence began providing protection for its Premium, Care, and Response users on February 27th, 2026, with a firewall rule designed to block known exploit attempts. Users of the free Wordfence plugin received similar protection on March 29th, 2026, 30 days later, following the standard disclosure timeline. Despite these protective measures, the active exploitation indicates that many sites remain vulnerable.

Given the critical nature of the vulnerability and the ongoing exploitation, users of the WooCommerce Wholesale Lead Capture plugin are strongly urged to update to version 2.0.3.2 immediately. This patched version addresses the arbitrary file upload flaw by properly validating file types, mitigating the risk of remote code execution. The plugin, which has an estimated 6,000 active installations, is a popular choice for e-commerce sites looking to streamline wholesale customer registration.

The vulnerability carries a CVSS score of 9.8, classifying it as Critical. The researcher credited with discovering this flaw is Teemu Saarentaus. The active exploitation and high severity highlight the ongoing challenges in securing the vast WordPress ecosystem, where even seemingly niche plugins can become targets for widespread attacks.