Urgent Alert: Critical WooCommerce Plugin Flaw Actively Exploited to Deploy PHP Web Shells

E-commerce security is facing a highly dangerous wave of targeted attacks. This week, cybersecurity researchers identified a massive campaign exploiting a critical vulnerability in a popular WordPress and WooCommerce extension. If your business operates an online store, immediate action is required to prevent attackers from seizing complete control of your web server and harvesting sensitive customer data.

Executive summary

• A critical vulnerability, CVE-2026-27540 (CVSS score 9.8), in the WooCommerce Wholesale Lead Capture plugin is being actively exploited in the wild.
• Unauthenticated attackers can bypass file validation to upload malicious PHP files (web shells) and gain full remote code execution (RCE) on the server.
• Over 100,000 exploit attempts have been blocked by security providers recently, indicating an intense and ongoing threat campaign.
• Immediate action required: Update the plugin to version 2.0.3.2 and perform a thorough compromise assessment.

What happened?

WooCommerce Wholesale Lead Capture is a premium WordPress plugin used by approximately 6,000 business-to-business (B2B) merchants to register and manage wholesale buyers. The vulnerability, tracked as CVE-2026-27540, affects all versions up to and including 2.0.3.1. Because it is a commercial plugin, many websites that let their licenses expire are left unpatched, leaving them highly exposed to automated exploitation.

How the attack works at a high level

The security defect lies in the lack of server-side file type validation within a public AJAX endpoint named 'wwlcfileupload_handler'. This endpoint is designed to process registration attachments from prospective wholesale buyers. Unauthenticated visitors can access this handler directly. Attackers send crafted requests to bypass client-side restrictions and upload a malicious PHP backdoor (such as 'shell.php'). Once uploaded, they access the web shell via a browser to execute arbitrary commands, download malware, or harvest database credentials.

Why this is a business risk

For e-commerce businesses, a server compromise is catastrophic. Attackers can inject payment skimmers into checkout pages to steal customer credit card details, access confidential wholesale buyer databases, deface the website, or use the server to launch further attacks. This leads to severe reputational damage, direct financial loss, search engine (SEO) blacklisting, and potential compliance penalties.

What businesses should do in the next 24–72 hours

• Verify if your WordPress/WooCommerce site is using the WooCommerce Wholesale Lead Capture plugin.
• Immediately update the plugin to version 2.0.3.2. Ensure your commercial license is active to receive the update from the vendor, Rymera Web Co.
• Scan your website's uploads directory for any unexpected or recently modified '.php' files.
• Review server access logs for suspicious requests to '/wp-admin/admin-ajax.php' where the action parameter is set to 'wwlcfileupload_handler'.

Other notable CMS and enterprise risks of the week

In addition to the WooCommerce threat, two other major vulnerabilities were added to CISA's Known Exploited Vulnerabilities (KEV) catalog this week. First is a critical GitLab CE/EE Path Traversal flaw (CVE-2026-85706, CVSS 10.0) allowing unauthenticated remote file reads on self-managed instances. Second is a Cisco Secure Email Gateway flaw (CVE-2026-76461) being actively exploited to execute root commands. Organizations using these platforms should patch immediately.

Long-term lessons for CMS and digital infrastructure security

This campaign highlights a common blind spot in digital operations: the 'expired license' trap. Many businesses purchase premium plugins but fail to renew their licenses, leaving them without critical security updates. To mitigate this, enterprises must establish a robust patch management policy, deploy a Web Application Firewall (WAF) to block automated exploit attempts, and maintain isolated daily backups to ensure rapid recovery in the event of an incident.

How Hanoi Byte can help

If your business relies on WordPress, WooCommerce, a custom CMS, or cloud-based digital infrastructure, Hanoi Byte can help you assess risks, modernize your systems, and build a practical security and maintenance roadmap. We partner with businesses to deliver tailored digital transformation and cybersecurity solutions, ensuring your operations remain secure, scalable, and resilient. Contact Hanoi Byte today to start a conversation about securing and optimizing your digital assets.