LmCast :: Stay tuned in

Hackers target WordPress sites via third-party WooCommerce plugin

Recorded: Sept. 15, 2026, 2:46 p.m.

Original Summarized

Hackers target WordPress sites via third-party WooCommerce plugin

News

Featured
Latest

Hackers hijack HBO Max Reddit account to push malware in ClickFix ads

Homebrew 7.0.0 gets built-in GUI, better security controls

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

New Android malware encrypts files, steals data, and harasses victims

Hackers target WordPress sites via third-party WooCommerce plugin

What Zero-Day Response Should Be in the Post-Mythos Era

CISA: Critical VMware RCE flaw now exploited by ransomware gangs

This lifetime stock-picking subscription is $68.99 (reg. $486)

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityHackers target WordPress sites via third-party WooCommerce plugin

Hackers target WordPress sites via third-party WooCommerce plugin

By Bill Toulas

September 15, 2026
10:45 AM
0

Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress to upload a PHP backdoor.
The flaw is tracked as CVE-2026-27540 and impacts plugin versions 2.0.3.1 and older. It is an unauthenticated arbitrary file-upload vulnerability discovered by security researcher Teemu Saarentaus.
An attacker can exploit it to upload PHP webshells and execute code, potentially leading to a complete site compromise.
From a technical standpoint, the flaw is caused by exposing  an unauthenticated AJAX action named wwlc_file_upload_handler, which checks file extensions against an allowlist supplied through the user-controlled file_settings request parameter.
This allows adding ‘php’ to the permitted file types, making the plugin accept PHP executable file uploads.
The vulnerability was addressed in version 2.0.3.2 of the WooCommerce Wholesale Lead Capture plugin, released on February 20.
However, WordPress security company Defiant is warning that its Wordfence web application firewall blocked over 100,000 attacks linked to CVE-2026-27540.
Wordfence reports that exploitation activity spiked between June 4 and June 17, and on July 1 and August 30.
During the attacks, the hackers upload a webshell that conducts reconnaissance but can also introduce additional payloads.
“The attacker submits a request to the wwlc_file_upload_handler AJAX action containing a forged file_settings parameter and a malicious file with a .php extension,” Wordfence explains.
“The uploaded shell.php is a PHP webshell that reports host details and provides a browser-based upload form for writing additional malicious files to the site.”

Example attack requestSource: Wordfence
Wordfence provides a set of high-offender IP addresses that deployed tens of thousands of exploitation attempts. Administrators are recommended to add them to a blocklist and upgrade to plugin version 2.0.3.2 or later that addresses the security problem.
The researchers advise checking upload directories for unexpected or recently created PHP files, examining logs for requests to /wp-admin/admin-ajax.php invoking wwlc_file_upload_handler, and removing unknown administrator accounts.
If compromise is confirmed, the recommended action is to restore the website from a safe backup, as removing all persistence mechanisms, users, and backdoors may be complicated.

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Save your seat

Related Articles:
Critical Elementor Pro flaw exploited to take over WordPress sitesHackers target WordPress sites in miniOrange auth bypass attacksCritical Elementor Pro bug exposes WordPress sites to RCE attacksWordPress membership plugin bug exploited to create admin accountsCritical wp2shell WordPress flaws exploited to install webshells

Actively Exploited
File Upload
Plugin
Vulnerability
WooCommerce
WordPress

Bill Toulas
Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.

Previous Article

Post a Comment Community Rules

You need to login in order to post a comment

Not a member yet? Register Now

You may also like:

  Upcoming Webinar

Popular Stories

Microsoft releases emergency Windows updates to fix RDS failures

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

Microsoft: September updates cause RDS failures on Windows Server

Sponsor Posts

EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain

Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. 

Watch a working exploit hit live controls and see exactly what blocks, detects, or misses

Patch automation needs more than speed. Action1 brings control into every stage of deployment.

Overdue a password health-check? Audit your Active Directory for free

Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday.

  Upcoming Webinar

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

Hackers are actively exploiting a critical vulnerability within the WooCommerce Wholesale Lead Capture premium plugin for WordPress, which allows for the upload of a PHP backdoor. This flaw is tracked as CVE-2026-27540 and affects plugin versions 2.0.3.1 and earlier. The vulnerability stems from an unauthenticated arbitrary file-upload mechanism discovered by security researcher Teemu Saarentaus. Technically, the vulnerability exists because the plugin exposes an unauthenticated AJAX action named wwlc_file_upload_handler that insufficiently validates file extensions against an allowlist supplied via the user-controlled file_settings request parameter. By manipulating this parameter, an attacker could introduce 'php' into the list of permitted file types, thereby enabling the upload of executable PHP files.

The exploitation process involved the attacker submitting a request to the wwlc_file_upload_handler AJAX action, providing a forged file_settings parameter along with a malicious file extension, such as .php. This allowed the upload of a PHP webshell, which provided the attacker with the ability to conduct reconnaissance on the host system and offered a browser-based interface for writing additional malicious files to the site.

Following the discovery, the WordPress security company Defiant reported that its Wordfence web application firewall successfully blocked over 100,000 attacks linked to CVE-2026-27540. Exploitation activity peaked between June 4 and June 17, and again on July 1 and August 30, during which hackers deployed webshells to gather information and introduce further payloads. The vulnerability was patched in version 2.0.3.2 of the plugin, which was released on February 20.

Administrators are advised to implement several defensive measures. These recommendations include adding specific high-offender IP addresses to a blocklist, upgrading the plugin to version 2.0.3.2 or later to resolve the security issue, and proactively auditing the server. Recommended steps involve checking upload directories for any unexpected or recently created PHP files, examining server logs for requests to /wp-admin/admin-ajax.php that invoke the wwlc_file_upload_handler, and removing any unknown administrator accounts. If a compromise is confirmed, the most recommended action is to restore the website from a secure backup, as removing all persistence mechanisms, user accounts, and backdoors can be complex. Bill Toulas, a technology writer and infosec news reporter, covered this incident.