Attackers Exploit WooCommerce Plugin Flaw to Install PHP Web Shells

Threat actors are actively exploiting a critical file-upload vulnerability in WooCommerce Wholesale Lead Capture, a premium WordPress plugin used by more than 6,000 websites.

The flaw, tracked as CVE-2026-27540, allows an unauthenticated attacker to place arbitrary files on a vulnerable server. Those files can include executable PHP backdoors, giving the attacker a route to remote code execution and potentially complete control of the WordPress installation.

Wordfence has blocked more than 100,000 exploitation attempts since June 2026. It recorded 99 attempts during the 24-hour period preceding its report, indicating that scanning and exploitation remain active.

The disclosure also details two unauthenticated code-execution vulnerabilities in The Events Calendar, another WordPress plugin with more than 600,000 installations. Fixed versions are available for those flaws, but no confirmed patched release has been identified for WooCommerce Wholesale Lead Capture.

Forged upload settings let attackers plant PHP code

CVE-2026-27540 affects WooCommerce Wholesale Lead Capture versions up to and including 2.0.3.1. The plugin is developed by Rymera Web Co Pty Ltd.

The vulnerable component is the WordPress AJAX action:

wwlc_file_upload_handler

The handler does not adequately validate the type of file being uploaded. An attacker does not need a WordPress account or any other privileges to reach the vulnerable functionality.

Observed attacks send a crafted request containing a forged file_settings parameter. This causes the server to accept an attacker-controlled file, including one containing executable PHP code.

In the campaign documented by Wordfence, the uploaded payload was named:

shell.php

The file acts as a browser-accessible web shell. It displays information about the compromised host and provides an upload form through which an attacker can write additional files into the WordPress installation.

That first file is therefore not necessarily the final payload. Attackers can use it to deploy more capable backdoors, modify application code, steal configuration secrets, alter content, or create additional persistence.

The vulnerability is classified as CWE-434, or unrestricted upload of a file with a dangerous type. Its CVSS v3.1 rating is 9.0, using the vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The vector describes a network-accessible attack requiring no privileges or user interaction. It assigns high attack complexity but also high confidentiality, integrity, and availability impact, with the compromise crossing a security boundary. Some reporting, citing Wordfence, has assigned the issue a higher score of 9.8.

Logs and upload directories provide the clearest evidence

Administrators should search web-server, reverse-proxy, firewall, and WordPress logs for requests to:

/wp-admin/admin-ajax.php

The strongest request-level indicator is an action parameter containing:

wwlc_file_upload_handler

A request to that action does not by itself prove successful compromise. Defenders should correlate it with HTTP response codes, file-creation events, PHP execution, and subsequent requests to newly uploaded resources.

The following addresses were associated with observed exploitation attempts:

92.241.13.213
31.59.129.150
2a0f:85c1:840:5389::1
92.241.13.140
23.137.105.214
23.180.120.140
104.194.9.138
187.75.114.36
114.10.43.203
37.114.144.209

These indicators can support retrospective searches and temporary blocking, but they should not be treated as a complete attacker list. Exploitation may originate from different addresses, including compromised infrastructure.

Filesystem reviews should focus on recently created or modified .php files, particularly inside WordPress upload directories where executable code would not normally be expected. Defenders should specifically search for shell.php, while recognizing that attackers can rename the payload.

Useful correlation points include files created close to suspicious AJAX requests, access to those files immediately after creation, unexpected outbound connections, and PHP processes launching system utilities.

Deleting the visible shell is not sufficient. Once arbitrary PHP has executed, the attacker may have created administrator accounts, changed passwords, installed plugins, modified themes, added scheduled tasks, or placed secondary backdoors elsewhere.

No confirmed fixed WooCommerce Wholesale Lead Capture release is known

A fixed version of WooCommerce Wholesale Lead Capture has not been identified. All releases through 2.0.3.1 should therefore be treated as vulnerable.

Administrators should deploy a vendor-fixed release as soon as one is confirmed. Until then, sites should disable and remove the affected plugin where operationally possible, or prevent external access to the vulnerable action using web-server or web application firewall controls.

Sites showing signs of exploitation should be isolated before remediation. Responders should preserve web, application, authentication, and filesystem logs before removing malicious files.

Recovery should include rotating WordPress, hosting, database, FTP, SSH, and control-panel credentials as applicable. Teams should also review administrator accounts, password-reset events, installed plugins, theme modifications, scheduled jobs, startup mechanisms, and other locations that could provide persistence.

There is no known CISA Known Exploited Vulnerabilities catalog entry or associated federal remediation deadline for CVE-2026-27540. The absence of a KEV listing does not change the observed exploitation data: Wordfence has already recorded large-scale attack traffic against the flaw.

The Events Calendar has two separate critical RCE paths

The same reporting covers two critical vulnerabilities in The Events Calendar, which is installed on more than 600,000 WordPress sites. Both flaws can be exploited without authentication, but they use different paths through the plugin’s widget-rendering functionality.

CVE-2026-78159 affects versions through 6.17.3 and was fixed in version 6.17.3.1. It carries a CVSS score of 9.8:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The vulnerability results from insufficient validation of the widget classes map in the parse_array function. A plain-array payload can bypass an object safety check and reach a callable-invocation path in Element_Classes::parse_array().

The issue is classified as CWE-94, improper control over code generation. The exploitation chain can produce PHP Object Injection and ultimately execute operating-system commands.

Exploitation requires comments to be enabled on tribe_events posts and at least one relevant comment condition. The full condition has not been disclosed in the available technical description. Wordfence reported that pending-comment preview can trigger the chain without moderator approval.

The second issue, CVE-2026-78006, affects versions through 6.17.4 and is fixed in 6.17.4.1. It is also rated CVSS 9.8 with the same vector.

This vulnerability is classified as CWE-502, deserialization of untrusted data. PHP magic methods can execute during pre-parsing, while enable_rendering_widget_copied() can generate a valid wp_hash integrity value before data reaches unserialize(). That behavior lets an attacker bypass the intended object-injection protection.

The resulting arbitrary-callable capability can be used to reset an administrator’s password. An attacker could then authenticate, upload a malicious plugin, and take full control of the website.

WordPress operators should prioritize updates and compromise checks

The Events Calendar users should upgrade to at least version 6.17.4.1, which is the later of the two fixed releases and addresses sites exposed through the affected version ranges.

WooCommerce Wholesale Lead Capture presents the more difficult immediate decision because no fixed release is known. Operators running version 2.0.3.1 or earlier should disable the plugin or tightly restrict the vulnerable AJAX route while monitoring for a confirmed vendor update.

For all three vulnerabilities, patching or disabling the affected component only closes the initial entry point. Any site with suspicious requests, unexpected PHP files, administrator changes, or unauthorized plugins should be handled as a potential server compromise and investigated accordingly.