CVE-2026-27540

Critical9.0Published on March 19, 2026

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1.

Early warning: exploitation observed

Exploitation observed since Feb 20, 2026
Not yet in the official CISA catalogue
Attacked 27 days before the vulnerability was made public

Source: VulnCheck KEV · Sep 14, 2026 Mar 19, 2026 Feb 25, 2026 Feb 20, 2026

CVSS score9.0 / 10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-434

Vulnerabilities

Attackers Exploit WooCommerce Plugin Flaw to Install PHP Web Shells

Attackers exploit CVE-2026-27540 in a WooCommerce plugin to upload PHP web shells. Learn the indicators, impact, and recommended defenses.

Sep 16, 202611:315 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Early warning: exploitation observed

Related articles

Attackers Exploit WooCommerce Plugin Flaw to Install PHP Web Shells