CVE-2026-27540: Unauthenticated Arbitrary File Upload in WooCommerce Wholesale Lead Capture Plugin Actively Exploited

CVE-2026-27540 (TL-2026-2539) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-09-16. It has no confirmed attribution, affects Rymera Web Co Pty Ltd WooCommerce Wholesale Lead Capture, references 1 CVE (CVE-2026-27540), maps to 9 MITRE ATT&CK techniques (T1005, T1036, T1071.001), and is covered by 9 detection rules and 12 indicators of compromise.

Key facts for TL-2026-2539

Threat ID
TL-2026-2539
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-16
Last reviewed
2026-09-16
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
ecommerce, retail, small-and-medium-business
Target regions
Global
Detection rules
9
Indicators of compromise
12

An unauthenticated arbitrary file-upload vulnerability (CVE-2026-27540, CWE-434) in the WooCommerce Wholesale Lead Capture WordPress plugin (<= 2.0.3.1) lets attackers forge the file_settings AJAX parameter to add 'php' to the allowed-extension list and upload PHP web shells through the wwlc_file_upload_handler action. Wordfence has blocked over 100,000 exploitation attempts since June 2026, with spikes June 4-17, July 1, and August 30, targeting an estimated 6,000 active installations.

How CVE-2026-27540 works

WooCommerce Wholesale Lead Capture, a premium lead-capture add-on for WooCommerce built by Rymera Web Co Pty Ltd, exposes an unauthenticated AJAX action named wwlc_file_upload_handler. The handler determines which file extensions are permitted for upload by reading a client-supplied file_settings request parameter instead of enforcing a server-side allowlist. Because the check trusts attacker-controlled input, an unauthenticated attacker can submit a forged file_settings value that includes 'php' among the allowed extensions, then upload an arbitrary .php file that the plugin accepts as valid. Researcher Teemu Saarentaus is credited with discovering the flaw (CWE-434, Unrestricted Upload of File with Dangerous Type), which the vendor patched in version 2.0.3.2, released February 20, 2026. Wordfence added the vulnerability to its intelligence database on February 25, 2026 and deployed a Premium firewall rule on February 27, 2026, ahead of a formal NVD CVE record published March 19, 2026 (NVD scores the flaw 9.0 Critical, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; Wordfence and press coverage cite the higher 9.8 Critical rating reflecting the network-exploitable, no-authentication, no-user-interaction nature of the bug). In observed attacks, threat actors submit crafted POST requests to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler, a forged file_settings parameter, and a malicious file named shell.php. The dropped web shell performs host reconnaissance and exposes a browser-based upload form that lets the attacker write additional malicious files to the compromised site, enabling follow-on actions such as running arbitrary commands, planting additional malware, creating unauthorized WordPress administrator accounts, exfiltrating site/customer data, and modifying or defacing pages -- amounting to full site takeover. Exploitation has been continuous and opportunistic (consistent with automated, unauthenticated, mass-scanning campaigns rather than a single targeted actor): Wordfence recorded a major spike June 4-17, 2026, a second wave July 1, 2026, and further activity August 30, 2026, with 99 blocked attempts in the 24 hours preceding the September 15-16, 2026 press coverage by BleepingComputer and The Hacker News. The vulnerability is not listed in the CISA KEV catalog as of September 16, 2026, and no BeaconBeagle C2 correlation was found for the reported source IPs, consistent with opportunistic web-shell drops rather than an attributed C2 infrastructure campaign.

MITRE ATT&CK techniques used in TL-2026-2539

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Discovery

T1082 System Information Discovery

Persistence

T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in CVE-2026-27540

  • Rymera Web Co Pty Ltd — WooCommerce Wholesale Lead Capture
    Vulnerable versions: <= 2.0.3.1
    Fixed in: 2.0.3.2

Remediation for CVE-2026-27540

Patches

  • WooCommerce Wholesale Lead Capture version 2.0.3.2 (released February 20, 2026) fixes the file-type validation logic

Immediate actions

  • Update WooCommerce Wholesale Lead Capture to version 2.0.3.2 or later immediately
  • Check the wp-content/uploads directory tree for unexpected or recently created .php files, especially any named shell.php
  • Review web server / admin-ajax.php access logs for POST requests with action=wwlc_file_upload_handler
  • Remove any unrecognized or newly created WordPress administrator accounts
  • Restore from a known-clean backup if compromise indicators are found

Workarounds

  • If immediate patching is not possible, deactivate the WooCommerce Wholesale Lead Capture plugin or block access to admin-ajax.php action=wwlc_file_upload_handler at the WAF/reverse proxy

Longer-term hardening

  • Deploy a web application firewall rule blocking unauthenticated requests to wwlc_file_upload_handler for unpatched sites
  • Disable PHP execution in the wp-content/uploads directory via web server configuration
  • Maintain an inventory of installed WordPress/WooCommerce plugins and subscribe to a vulnerability intelligence feed (e.g., Wordfence) for timely patch alerts
  • Enforce least-privilege file permissions on plugin upload handlers and audit third-party plugins for server-side validation of client-supplied parameters

CVEs associated with CVE-2026-27540

CVE-2026-27540

Weaknesses (CWE) in CVE-2026-27540

CWE-434

Timeline of CVE-2026-27540

  • Rymera Web Co released WooCommerce Wholesale Lead Capture version 2.0.3.2, fixing the arbitrary file-upload flaw in wwlc_file_upload_handler.
  • Wordfence added CVE-2026-27540 to its vulnerability intelligence database.
  • Wordfence deployed a Premium firewall rule to block exploitation attempts against unpatched sites.
  • NVD published the formal CVE-2026-27540 record with CVSS 3.1 base score 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and CWE-434.
  • Wordfence observed the start of a major exploitation spike against the vulnerability, continuing through June 17.
  • End of the June 4-17 exploitation spike window tracked by Wordfence.
  • A second wave of exploitation attempts against wwlc_file_upload_handler was recorded.
  • Additional exploitation activity was recorded by Wordfence.
  • BleepingComputer reported active exploitation of CVE-2026-27540, noting 99 blocked attack attempts in the preceding 24 hours and citing over 100,000 total blocked exploit attempts since June 2026.
  • The Hacker News published coverage of the ongoing PHP web shell campaign against WooCommerce Wholesale Lead Capture, corroborating Wordfence's IOC and statistics reporting.

Sources cited for CVE-2026-27540

More in vulnerability

Detection coverage for TL-2026-2539

As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2539 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats