# CVE-2026-27540: Unauthenticated Arbitrary File Upload in WooCommerce Wholesale Lead Capture Plugin Actively Exploited

> An unauthenticated arbitrary file-upload vulnerability (CVE-2026-27540, CWE-434) in the WooCommerce Wholesale Lead Capture WordPress plugin (<= 2.0.3.1) lets attackers forge the file_settings AJAX parameter to add 'php' to the allowed-extension list and upload PHP web shells through the wwlc_file_upload_handler action. Wordfence has blocked over 100,000 exploitation attempts since June 2026, with spikes June 4-17, July 1, and August 30, targeting an estimated 6,000 active installations.

- **Published:** 2026-09-16T00:00:00Z
- **Last reviewed:** 2026-09-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2539
- **ID:** TL-2026-2539
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-27540

## Description

WooCommerce Wholesale Lead Capture, a premium lead-capture add-on for WooCommerce built by Rymera Web Co Pty Ltd, exposes an unauthenticated AJAX action named wwlc_file_upload_handler. The handler determines which file extensions are permitted for upload by reading a client-supplied file_settings request parameter instead of enforcing a server-side allowlist. Because the check trusts attacker-controlled input, an unauthenticated attacker can submit a forged file_settings value that includes 'php' among the allowed extensions, then upload an arbitrary .php file that the plugin accepts as valid. Researcher Teemu Saarentaus is credited with discovering the flaw (CWE-434, Unrestricted Upload of File with Dangerous Type), which the vendor patched in version 2.0.3.2, released February 20, 2026. Wordfence added the vulnerability to its intelligence database on February 25, 2026 and deployed a Premium firewall rule on February 27, 2026, ahead of a formal NVD CVE record published March 19, 2026 (NVD scores the flaw 9.0 Critical, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; Wordfence and press coverage cite the higher 9.8 Critical rating reflecting the network-exploitable, no-authentication, no-user-interaction nature of the bug). In observed attacks, threat actors submit crafted POST requests to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler, a forged file_settings parameter, and a malicious file named shell.php. The dropped web shell performs host reconnaissance and exposes a browser-based upload form that lets the attacker write additional malicious files to the compromised site, enabling follow-on actions such as running arbitrary commands, planting additional malware, creating unauthorized WordPress administrator accounts, exfiltrating site/customer data, and modifying or defacing pages -- amounting to full site takeover. Exploitation has been continuous and opportunistic (consistent with automated, unauthenticated, mass-scanning campaigns rather than a single targeted actor): Wordfence recorded a major spike June 4-17, 2026, a second wave July 1, 2026, and further activity August 30, 2026, with 99 blocked attempts in the 24 hours preceding the September 15-16, 2026 press coverage by BleepingComputer and The Hacker News. The vulnerability is not listed in the CISA KEV catalog as of September 16, 2026, and no BeaconBeagle C2 correlation was found for the reported source IPs, consistent with opportunistic web-shell drops rather than an attributed C2 infrastructure campaign.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1036 Masquerading
- T1505.003 Server Software Component: Web Shell
- T1136.001 Create Account: Local Account
- T1082 System Information Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1005 Data from Local System
- T1565.001 Data Manipulation: Stored Data Manipulation

## Sources

- [Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells](https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html)
- [Hackers target WordPress sites via third-party WooCommerce plugin](https://www.bleepingcomputer.com/news/security/hackers-target-wordpress-sites-via-third-party-woocommerce-plugin/)
- [Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors](https://gbhackers.com/woocommerce-plugin-vulnerability/)
- [WooCommerce Plugin Bug Lets Remote Attackers Create Admin Accounts and Take Over Sites](https://cyberpress.org/woocommerce-flaw-enables-site-takeover/)
- [WooCommerce Wholesale Lead Capture Exploited in the Wild](https://securityonline.info/woocommerce-wholesale-lead-capture-vulnerability/)
- [woocommerce-wholesale-lead-capture: CVE-2026-27540](https://www.rapid7.com/db/vulnerabilities/woocommerce-wholesale-lead-capture-plugin-cve-2026-27540/)
- [CVE-2026-27540 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-27540)
- [WordPress Woocommerce Wholesale Lead Capture Plugin <= 2.0.3.1 - Arbitrary File Upload Vulnerability](https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve)
- [CVE-2026-27540: WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload](https://exploit-intel.com/vuln/CVE-2026-27540)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2539