WooCommerce Lead Capture Flaw Allows Full Site Takeover

Attackers are actively exploiting a critical security flaw in the WooCommerce Wholesale Lead Capture premium WordPress plugin that allows for complete server takeover. The vulnerability enables remote actors to upload malicious files without any authentication, bypassing standard security checks to execute arbitrary code.

Tracked as CVE-2026-27540, the vulnerability carries a CVSS severity score of 9.8, reflecting its extreme risk to site owners. The flaw resides in the plugin's unauthenticated AJAX upload handler, specifically 'wwlc_file_upload_handler'. Technical reports indicate the handler incorrectly trusts user-supplied 'file_settings' to determine which file extensions are permitted, allowing attackers to bypass validation and upload PHP backdoors. Wordfence has already reported blocking more than 100,000 exploit attempts targeting this specific vulnerability.

The Scope of the Threat

WooCommerce Wholesale Lead Capture is a premium extension designed to help online merchants manage wholesale registration applications. A core feature of the plugin is the collection of business documentation via file upload fields, which is where the security failure occurs. By trusting client-controlled configuration data rather than enforcing strict server-side validation, the plugin creates an open door for remote attackers.

All versions of the plugin up to and including 2.0.3.1 are affected. While the plugin is a premium offering, it is estimated that approximately 6,000 active installations are currently vulnerable to this attack.

Industry Implications

Because the exploit requires no valid WordPress account or administrator privileges, the barrier to entry for attackers is virtually non-existent. The result is full remote code execution without needing any interaction from a site user.

Once a PHP webshell is successfully uploaded, an attacker gains a persistent foothold on the server. This level of access allows them to steal sensitive customer data, modify the storefront's content, or create rogue administrator accounts to maintain long-term control. Furthermore, compromised servers are frequently repurposed as infrastructure for wider spam and phishing campaigns, potentially damaging the reputation of the affected business and its hosting provider.

Next Steps for Administrators

Site administrators using the WooCommerce Wholesale Lead Capture plugin should immediately verify their version number and apply available security updates. Because the vulnerability is being actively exploited in the wild, immediate patching is the only reliable way to prevent a breach.

Security researchers continue to monitor the volume of attack traffic. While the primary mechanism of the flaw—the 'wwlc_file_upload_handler'—has been identified, administrators are encouraged to review their server logs for unauthorized PHP files in upload directories as a sign of prior compromise.