Skip to navigation

Threat reportVulnerabilityTL-2026-2539

CVE-2026-27540: Unauthenticated Arbitrary File Upload in WooCommerce Wholesale Lead Capture Plugin Actively Exploited

criticalACTIVE

An unauthenticated arbitrary file-upload vulnerability (CVE-2026-27540, CWE-434) in the WooCommerce Wholesale Lead Capture WordPress plugin (<= 2.0.3.1) lets attackers forge the file_settings AJAX parameter to add 'php' to the allowed-extension list and upload PHP web shells through the wwlc_file_upload_handler action.

Key facts

IdentifiersTL-2026-2539, CVE-2026-27540
SeverityCRITICAL
CVSS9.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
EPSSCVE-2026-27540: 2.3% (82.5th percentile)
Affected productsRymera Web Co Pty Ltd WooCommerce Wholesale Lead Capture
Weaknesses (CWE)CWE-434
MITRE ATT&CK techniquesT1005 Data from Local System, T1036 Masquerading, T1071.001 Application Layer Protocol: Web Protocols, T1082 System Information Discovery, T1136.001 Create Account: Local Account, T1190 Exploit Public-Facing Application, T1505.003 Server Software Component: Web Shell, T1565.001 Data Manipulation: Stored Data Manipulation, T1595.002 Vulnerability Scanning
MotivationUNKNOWN
Target sectorsecommerce, retail, small-and-medium-business
Target regionsGlobal
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage

As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2539 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WWLC AJAX File-Type Allowlist Forgery Exploit Attempt (CVE-2026-27540)

Detects unauthenticated requests to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler where the client-supplied file_settings parameter has been forged to add 'php' to the allowed-extension list, or where a .php filename (e.g. shell.php) is submitted as the upload payload. This is the exploitation stage of CVE-2026-27540 against WooCommerce Wholesale Lead Capture <= 2.0.3.1.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1595.002, T1036
  • Data sources: web_access_logs, modsecurity_waf_audit_log, wordfence_firewall_log
  • Severity: critical
  • Confidence: high

Splunk SPL

`comment("Primary: WordPress access log hit on the vulnerable AJAX action")`
index=web (sourcetype=access_combined OR sourcetype=nginx:plus:kv)
  uri="*admin-ajax.php*action=wwlc_file_upload_handler*"
| eval http_status=status
| stats count as request_count min(_time) as first_seen max(_time) as last_seen values(http_method) as methods by src_ip, uri, http_status
``comment("Enrich with full-body WAF/ModSecurity inspection to confirm the forged file_settings + shell.php payload")``
| join type=left src_ip
    [ search index=waf sourcetype=modsecurity "file_settings" "php"
      | rex field=_raw "(?i)file_settings=(?<forged_settings>[^&\"]+)"
      | rex field=_raw "(?i)filename=\"?(?<upload_filename>[^\"&]+\.php)\"?"
      | eval waf_body_match=1
      | stats count as body_match_count values(upload_filename) as uploaded_files by src_ip ]
| eval risk_score=if(isnotnull(body_match_count) AND body_match_count>0, "critical", "high")
| where request_count>=1
| table first_seen, last_seen, src_ip, uri, http_status, request_count, methods, body_match_count, uploaded_files, risk_score
| sort - risk_score

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has "admin-ajax.php" and RequestURL has "action=wwlc_file_upload_handler"
| extend ForgedFileSettings = iff(RequestURL has "file_settings", true, false)
| extend UploadedShellExt = iff(RequestURL has ".php" or RequestURL has "shell.php", true, false)
| where ForgedFileSettings or UploadedShellExt
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), URLs = make_set(RequestURL, 20), Methods = make_set(RequestMethod, 5) by SourceIP, DeviceAction
| where RequestCount >= 1
| sort by RequestCount desc

Sigma

title: WooCommerce WWLC Unauthenticated File-Upload Extension Forgery (CVE-2026-27540)
id: 7a4c1e2d-9f3b-4a6e-8c7d-2b1f5e9a3c40
status: experimental
description: Detects requests to the WordPress admin-ajax.php endpoint invoking the vulnerable wwlc_file_upload_handler action with a forged file_settings parameter or a .php upload filename, consistent with unauthenticated exploitation of CVE-2026-27540 in WooCommerce Wholesale Lead Capture <= 2.0.3.1.
references:
  - https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html
  - https://www.bleepingcomputer.com/news/security/hackers-target-wordpress-sites-via-third-party-woocommerce-plugin/
  - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-27540
author: Threadlinqs Team
date: 2026-09-16
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.initial-access
  - attack.t1190
  - attack.defense-evasion
  - attack.t1036
  - cve.2026.27540
  - cwe.434
logsource:
  category: webserver
  product: nginx
detection:
  selection_endpoint:
    cs-uri-query|contains: 'admin-ajax.php'
  selection_action:
    cs-uri-query|contains: 'action=wwlc_file_upload_handler'
  selection_forgery:
    cs-uri-query|contains:
      - 'file_settings'
      - '.php'
      - 'shell.php'
  condition: selection_endpoint and selection_action and selection_forgery
falsepositives:
  - Legitimate WWLC lead-capture file uploads of allowed non-PHP document types (rare co-occurrence of file_settings + .php in a benign request is unlikely)
level: critical

Known false positives:

  • Vulnerability scanners or authorized penetration testers replaying the PoC request against a patched (>= 2.0.3.2) site during validation testing

Tuning notes: If access logs only capture the query string (not the POST body), pair this with a ModSecurity/Wordfence log source that logs multipart form fields so file_settings and the uploaded filename are visible; without that, alert on the action=wwlc_file_upload_handler hit alone and treat as high rather than critical.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • WWLC AJAX File-Type Allowlist Forgery Exploit Attempt (CVE-2026-27540) · unlock with TL Creds
  • Web Shell Command Execution and Host Recon from PHP/Web-Server Process (Post-WWLC Compromise) · unlock with TL Creds
  • Repeated [indicator] Web-Shell C2 Polling from Known CVE-2026-27540 Offender Infrastructure · unlock with TL Creds
  • WWLC AJAX File-Type Allowlist Forgery Exploit Attempt (CVE-2026-27540) · unlock with TL Creds
  • Web Shell Command Execution and Host Recon from PHP/Web-Server Process (Post-WWLC Compromise) · unlock with TL Creds
  • Repeated [indicator] Web-Shell C2 Polling from Known CVE-2026-27540 Offender Infrastructure · unlock with TL Creds
  • Web Shell Command Execution and Host Recon from PHP/Web-Server Process (Post-WWLC Compromise) · unlock with TL Creds
  • Repeated [indicator] Web-Shell C2 Polling from Known CVE-2026-27540 Offender Infrastructure · unlock with TL Creds

Indicators of compromise

As of 2026-09-16, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-2539.

Sample indicators (3 of 12)

  • IP address: 92.241.13[.]213
  • IP address: 31.59.129[.]150
  • IP address: 92.241.13[.]140

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

12 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Wordfence has blocked over 100,000 exploitation attempts since June 2026, with spikes June 4-17, July 1, and August 30, targeting an estimated 6,000 active installations.

WooCommerce Wholesale Lead Capture, a premium lead-capture add-on for WooCommerce built by Rymera Web Co Pty Ltd, exposes an unauthenticated AJAX action named wwlc_file_upload_handler. The handler determines which file extensions are permitted for upload by reading a client-supplied file_settings request parameter instead of enforcing a server-side allowlist. Because the check trusts attacker-controlled input, an unauthenticated attacker can submit a forged file_settings value that includes 'php' among the allowed extensions, then upload an arbitrary .php file that the plugin accepts as valid. Researcher Teemu Saarentaus is credited with discovering the flaw (CWE-434, Unrestricted Upload of File with Dangerous Type), which the vendor patched in version 2.0.3.2, released February 20, 2026. Wordfence added the vulnerability to its intelligence database on February 25, 2026 and deployed a Premium firewall rule on February 27, 2026, ahead of a formal NVD CVE record published March 19, 2026 (NVD scores the flaw 9.0 Critical, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; Wordfence and press coverage cite the higher 9.8 Critical rating reflecting the network-exploitable, no-authentication, no-user-interaction nature of the bug). In observed attacks, threat actors submit crafted POST requests to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler, a forged file_settings parameter, and a malicious file named shell.php. The dropped web shell performs host reconnaissance and exposes a browser-based upload form that lets the attacker write additional malicious files to the compromised site, enabling follow-on actions such as running arbitrary commands, planting additional malware, creating unauthorized WordPress administrator accounts, exfiltrating site/customer data, and modifying or defacing pages -- amounting to full site takeover. Exploitation has been continuous and opportunistic (consistent with automated, unauthenticated, mass-scanning campaigns rather than a single targeted actor): Wordfence recorded a major spike June 4-17, 2026, a second wave July 1, 2026, and further activity August 30, 2026, with 99 blocked attempts in the 24 hours preceding the September 15-16, 2026 press coverage by BleepingComputer and The Hacker News. The vulnerability is not listed in the CISA KEV catalog as of September 16, 2026, and no BeaconBeagle C2 correlation was found for the reported source IPs, consistent with opportunistic web-shell drops rather than an attributed C2 infrastructure campaign.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Discovery

T1082 System Information Discovery

Persistence

T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

  • WooCommerce Wholesale Lead Capture version 2.0.3.2 (released February 20, 2026) fixes the file-type validation logic

Immediate actions

  • Update WooCommerce Wholesale Lead Capture to version 2.0.3.2 or later immediately
  • Check the wp-content/uploads directory tree for unexpected or recently created .php files, especially any named shell.php
  • Review web server / admin-ajax.php access logs for POST requests with action=wwlc_file_upload_handler
  • Remove any unrecognized or newly created WordPress administrator accounts
  • Restore from a known-clean backup if compromise indicators are found

Workarounds

  • If immediate patching is not possible, deactivate the WooCommerce Wholesale Lead Capture plugin or block access to admin-ajax.php action=wwlc_file_upload_handler at the WAF/reverse proxy

Longer-term hardening

  • Deploy a web application firewall rule blocking unauthenticated requests to wwlc_file_upload_handler for unpatched sites
  • Disable PHP execution in the wp-content/uploads directory via web server configuration
  • Maintain an inventory of installed WordPress/WooCommerce plugins and subscribe to a vulnerability intelligence feed (e.g., Wordfence) for timely patch alerts
  • Enforce least-privilege file permissions on plugin upload handlers and audit third-party plugins for server-side validation of client-supplied parameters

Affected and fixed versions

  • Rymera Web Co Pty Ltd — WooCommerce Wholesale Lead Capture
    Vulnerable versions: <= 2.0.3.1
    Fixed in: 2.0.3.2

Timeline

  • Rymera Web Co released WooCommerce Wholesale Lead Capture version 2.0.3.2, fixing the arbitrary file-upload flaw in wwlc_file_upload_handler.
  • Wordfence added CVE-2026-27540 to its vulnerability intelligence database.
  • Wordfence deployed a Premium firewall rule to block exploitation attempts against unpatched sites.
  • NVD published the formal CVE-2026-27540 record with CVSS 3.1 base score 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and CWE-434.
  • Wordfence observed the start of a major exploitation spike against the vulnerability, continuing through June 17.
  • End of the June 4-17 exploitation spike window tracked by Wordfence.
  • A second wave of exploitation attempts against wwlc_file_upload_handler was recorded.
  • Additional exploitation activity was recorded by Wordfence.
  • BleepingComputer reported active exploitation of CVE-2026-27540, noting 99 blocked attack attempts in the preceding 24 hours and citing over 100,000 total blocked exploit attempts since June 2026.
  • The Hacker News published coverage of the ongoing PHP web shell campaign against WooCommerce Wholesale Lead Capture, corroborating Wordfence's IOC and statistics reporting.

Sources cited

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats