Hackers target WordPress sites via third-party WooCommerce plugin
Recorded: Sept. 15, 2026, 2:46 p.m.
| Original | Summarized |
Hackers target WordPress sites via third-party WooCommerce plugin News Featured Hackers hijack HBO Max Reddit account to push malware in ClickFix ads Homebrew 7.0.0 gets built-in GUI, better security controls Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent New Android malware encrypts files, steals data, and harasses victims Hackers target WordPress sites via third-party WooCommerce plugin What Zero-Day Response Should Be in the Post-Mythos Era CISA: Critical VMware RCE flaw now exploited by ransomware gangs This lifetime stock-picking subscription is $68.99 (reg. $486) Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityHackers target WordPress sites via third-party WooCommerce plugin Hackers target WordPress sites via third-party WooCommerce plugin By Bill Toulas September 15, 2026 Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress to upload a PHP backdoor. Example attack requestSource: Wordfence Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Related Articles: Actively Exploited Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Upcoming Webinar Popular Stories Microsoft releases emergency Windows updates to fix RDS failures Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent Microsoft: September updates cause RDS failures on Windows Server Sponsor Posts EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. Watch a working exploit hit live controls and see exactly what blocks, detects, or misses Patch automation needs more than speed. Action1 brings control into every stage of deployment. Overdue a password health-check? Audit your Active Directory for free Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Hackers are actively exploiting a critical vulnerability within the WooCommerce Wholesale Lead Capture premium plugin for WordPress, which allows for the upload of a PHP backdoor. This flaw is tracked as CVE-2026-27540 and affects plugin versions 2.0.3.1 and earlier. The vulnerability stems from an unauthenticated arbitrary file-upload mechanism discovered by security researcher Teemu Saarentaus. Technically, the vulnerability exists because the plugin exposes an unauthenticated AJAX action named wwlc_file_upload_handler that insufficiently validates file extensions against an allowlist supplied via the user-controlled file_settings request parameter. By manipulating this parameter, an attacker could introduce 'php' into the list of permitted file types, thereby enabling the upload of executable PHP files. The exploitation process involved the attacker submitting a request to the wwlc_file_upload_handler AJAX action, providing a forged file_settings parameter along with a malicious file extension, such as .php. This allowed the upload of a PHP webshell, which provided the attacker with the ability to conduct reconnaissance on the host system and offered a browser-based interface for writing additional malicious files to the site. Following the discovery, the WordPress security company Defiant reported that its Wordfence web application firewall successfully blocked over 100,000 attacks linked to CVE-2026-27540. Exploitation activity peaked between June 4 and June 17, and again on July 1 and August 30, during which hackers deployed webshells to gather information and introduce further payloads. The vulnerability was patched in version 2.0.3.2 of the plugin, which was released on February 20. Administrators are advised to implement several defensive measures. These recommendations include adding specific high-offender IP addresses to a blocklist, upgrading the plugin to version 2.0.3.2 or later to resolve the security issue, and proactively auditing the server. Recommended steps involve checking upload directories for any unexpected or recently created PHP files, examining server logs for requests to /wp-admin/admin-ajax.php that invoke the wwlc_file_upload_handler, and removing any unknown administrator accounts. If a compromise is confirmed, the most recommended action is to restore the website from a secure backup, as removing all persistence mechanisms, user accounts, and backdoors can be complex. Bill Toulas, a technology writer and infosec news reporter, covered this incident. |