Loading vulnerability…
Unauthenticated Arbitrary File Upload in WooCommerce Wholesale Lead Capture
CVE-2026-27540 is an unauthenticated arbitrary file-upload vulnerability in Rymera Web Co.'s WooCommerce Wholesale Lead Capture plugin for WordPress, affecting versions through 2.0.3.1. The public wwlc_file_upload_handler AJAX action validates file extensions against an allowlist supplied through the client-controlled file_settings parameter rather than trusted server-side configuration. The handler also disables WordPress MIME-type testing. Attackers can authorize PHP uploads by manipulating the allowlist, potentially enabling remote code execution through uploaded files. Active exploitation involving PHP webshells has been observed. Version 2.0.3.2 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthenticated attackers can upload arbitrary files to affected WordPress servers. Where uploaded PHP files can execute, exploitation enables remote code execution and potentially complete website compromise, including webshell deployment, site-file modification, administrator-account creation, data theft, and installation of additional malware or persistence mechanisms. The transition from arbitrary upload to code execution depends on server configuration, filesystem permissions, and PHP-execution controls.
If you can’t patch tonight, do this now.
If immediate upgrading is not possible, temporarily disable the plugin or its vulnerable upload functionality and restrict unnecessary network exposure. Available Wordfence and Patchstack firewall rules can block known exploitation attempts but do not remediate the vulnerable plugin. Monitor upload activity, relevant AJAX requests, and administrative changes for signs of exploitation.
Patch, then assume compromise.
Upgrade WooCommerce Wholesale Lead Capture to version 2.0.3.2 or later. Investigate previously exposed installations for unexpected PHP uploads, unauthorized administrator accounts, modified site files, suspicious scheduled tasks, and unusual outbound connections. If compromise is identified, preserve evidence, determine the scope of access, remove malicious files and accounts, investigate secondary persistence, rotate sensitive credentials, and invalidate active sessions. Restore from a known-safe backup where complete removal of backdoors and persistence cannot be assured.
3 exploits validated by Mallory's analysis.
50 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.