GoKawiilWooCommerce Wholesale Lead Capture flaw exploited to plant PHP backdoors
Hackers are exploiting an unauthenticated file-upload vulnerability (CVE-2026-27540) in the WooCommerce Wholesale Lead Capture plugin for WordPress, versions 2.0.3.1 and earlier, to install PHP webshells. Wordfence says its firewall has blocked over 100,000 attack attempts, with spikes in June, July and August, and the shells allow attackers to gather site information and upload further malicious files.
GoKawiil's interpretation of the reporting above, not reported fact.
The bug lets attackers bypass authentication entirely by manipulating a file-type allowlist parameter, turning a lead-capture tool into a full remote code execution vector and potential complete site takeover. Because the flaw affects a widely used WooCommerce add-on, unpatched e-commerce sites remain exposed to backdoor installation and follow-on attacks even though a fix has existed since February.
- CVE-2026-27540 lets unauthenticated attackers upload PHP webshells via the plugin's AJAX handler.
- Wordfence has blocked over 100,000 exploitation attempts, with major spikes in June and July-August.
- Site owners should update to version 2.0.3.2 or later and block known malicious IPs.
Source: bleepingcomputer.com, 2026-09-15
Published there as: “Hackers target WordPress sites via third-party WooCommerce plugin”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.