Loading story…
Attackers are actively exploiting CVE-2026-27540, a critical CVSS 9.8 unauthenticated arbitrary-file-upload flaw in the WordPress/WooCommerce Wholesale Lead Capture plugin. Versions through 2.0.3.1 trust attacker-controlled file-type settings in the public wholesale-registration form, allowing attackers to upload executable PHP files without logging in and gain remote code execution on the hosting server.
Exploitation has reportedly persisted for months, and Wordfence has blocked more than 100,000 attempts against roughly 6,000 active installations. Affected operators should upgrade to version 2.0.3.2 and investigate for PHP webshells, unauthorized administrator accounts, altered checkout content, persistence mechanisms, suspicious outbound connections, and related log activity.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Wordfence made the CVE-2026-27540 firewall rule available to users of its free version.
Wordfence Premium, Care, and Response users received a firewall rule for known CVE-2026-27540 exploitation.
Wordfence reported active exploitation of CVE-2026-27540 for months and said its firewall had blocked more than 100,000 attempts. Observed requests invoked the unauthenticated wwlc_file_upload_handler AJAX action to upload PHP webshells such as shell.php.
Wordfence observed an additional notable exploitation burst targeting the vulnerable upload handler on August 30.
Wordfence recorded another notable burst of exploit attempts against CVE-2026-27540 on July 1.
Wordfence observed elevated blocked exploitation activity targeting the vulnerable WooCommerce plugin between June 4 and June 17.
CVE-2026-27540 was disclosed as a critical unauthenticated arbitrary file-upload flaw in Wholesale Lead Capture Plugin for WooCommerce versions 2.0.3.1 and earlier. Version 2.0.3.2 remediates the issue, which can allow PHP webshell uploads through the public wholesale-registration upload handler.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers actively exploited a critical zero-day in the **Fancy Product Designer** plugin for WordPress, including deployments tied to **WooCommerce**, by scanning for vulnerable sites and abusing a malicious file upload flaw to achieve remote code execution. The vulnerability allowed unauthenticated attackers to upload executable PHP files, giving them a path to fully compromise affected websites. Researchers at **Wordfence** said the activity appeared focused on e-commerce sites, where intruders could steal order data containing customer personally identifiable information and expose merchants to potential **PCI-DSS** compliance issues. Wordfence observed exploitation beginning on January 30, 2021, and urged site owners to update to **Fancy Product Designer version `4.6.9`**, which was released to address the issue.
Aug 15, 2026
Attackers are actively exploiting `CVE-2026-14894`, a critical CVSS 9.8 unauthenticated arbitrary-file-upload vulnerability in the WordPress **Super Forms – Drag & Drop Form Builder** plugin through version `6.3.313`. Insufficient file-type validation and a weak nonce mechanism in unauthenticated AJAX handlers let attackers obtain a valid nonce, upload executable PHP files, and potentially gain remote code execution and full control of affected sites. Roughly 13,000 active installations may be exposed. Exploitation was observed beginning July 14 and surged between August 18 and 25, with Wordfence blocking more than 250,000 attempts. Attackers have deployed a PHP webshell named `Mushr00w_upl.php`. Administrators should immediately upgrade to Super Forms `6.3.314`, released July 8, and investigate web roots and upload directories for unexpected PHP files and suspicious requests to the plugin's vulnerable AJAX endpoint.
Sep 5, 2026
Attackers are actively exploiting **CVE-2026-0740**, a critical unauthenticated arbitrary file upload flaw in the **Ninja Forms File Uploads** premium add-on for WordPress that can lead to **remote code execution** and full site compromise. The vulnerability affects versions through `3.3.26` and stems from improper validation of file types and extensions in destination filenames, combined with missing filename sanitization that allows path traversal and placement of malicious PHP files in the webroot or other sensitive directories. Wordfence said it blocked more than **3,600** exploitation attempts in a 24-hour period and warned that attackers could use the bug to deploy web shells and take over vulnerable sites. Researcher **Sélim Lanouar** discovered the issue through Wordfence’s bug bounty program, and the vendor released a full fix in version `3.3.27` after an earlier partial remediation. Organizations using the add-on, which is deployed across more than **90,000** customer environments, have been urged to upgrade immediately.
Jun 29, 2026