Loading vulnerability…
CVE-2026-27540 is an unrestricted dangerous file-upload vulnerability in Rymera Web Co Pty Ltd.'s WooCommerce Wholesale Lead Capture WordPress plugin through version 2.0.3.1. The publicly reachable wholesale-registration upload handler relies on an attacker-controlled file-type allowlist supplied in the request rather than enforcing a trusted server-side allowlist. The handler also disables WordPress MIME-type validation. An unauthenticated attacker can authorize a PHP extension and upload executable PHP content, enabling server-side execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a single Python exploit script, a README, and a license file. The Python script is an interactive multi-target exploitation tool for two WordPress plugin vulnerabilities in WooCommerce Wholesale Lead Capture (WWLC): CVE-2026-27540 (unauthenticated arbitrary file upload leading to RCE) and CVE-2026-27542 (unauthenticated privilege escalation via registration role injection). The script uses requests with disabled TLS verification, multithreading via ThreadPoolExecutor, and an interactive CLI with two modes. Mode 1 uploads a PHP shell and then brute-forces the dynamically generated wwlc-temp-* folder beneath /wp-content/uploads to locate the uploaded file. Mode 2 submits crafted registration data to create a new user with administrator capabilities, then checks for admin access. The code appears operational rather than a simple detector: it performs exploitation, supports bulk target processing, writes results to local files, and includes hardcoded credentials/password defaults for the registration path. The README documents the intended vulnerable AJAX actions (wwlc_file_upload_handler and wwlc_create_user), the target endpoint (/wp-admin/admin-ajax.php), and the expected post-exploitation outcomes.
Repository contains a PoC/operational mass-exploitation script for an unauthenticated arbitrary file upload in the WordPress plugin “WooCommerce Wholesale Lead Capture” (claimed vulnerable version 2.0.3.1), mapped to CVE-2026-27540. Structure: - README.md: Explains the vulnerability, how to configure targets (kll.txt), set a payload file (e.g., a.php), run the script, and where uploaded files are expected to land under wp-content/uploads/wwlc-temp<random>/. - x.py: Main exploit. Multi-threaded (default 40 threads) scanner/uploader using Python requests + colorama. For each target base URL, it POSTs a multipart/form-data request to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler, an uploaded_file part (hardcoded name 404.php, MIME image/jpeg, content from PAYLOAD_PATH), and file_settings JSON. It retries on timeouts/connection errors, parses JSON responses, and treats status=="success" with a returned file_name as exploitation success. Capabilities: - Unauthenticated arbitrary file upload to WordPress via admin-ajax action. - Mass targeting: reads many sites from kll.txt, uses per-thread HTTP sessions, retries, and writes successful results to exploited.txt and uploads directory URLs to vuln.txt. - Intended post-exploitation: upload a PHP webshell to achieve RCE, but the script does not automatically discover the randomized wwlc-temp directory; README suggests manual discovery via directory listing under /wp-content/uploads. Notable implementation details: - TLS verification disabled (session.verify=False) and urllib3 warnings suppressed. - Hardcoded upload filename (404.php) and default payload path (/sdcard/1/404_protected.php), implying the operator must adjust PAYLOAD_PATH for their environment.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated arbitrary file-upload vulnerability in WooCommerce Wholesale Lead Capture for WordPress versions 2.0.3.1 and earlier. Its unauthenticated wwlc_file_upload_handler AJAX action accepts a user-controlled file-type allowlist via the file_settings parameter, allowing attackers to permit PHP uploads, deploy webshells, execute code, and potentially fully compromise a site.
A critical (CVSS 9.8) unauthenticated arbitrary file-upload vulnerability in the WooCommerce Wholesale Lead Capture extension. The public wholesale-registration upload handler trusts an attacker-supplied allowlist of file types, allowing upload of executable PHP code and resulting in remote server compromise.
A critical unauthenticated arbitrary-file-upload vulnerability in the WooCommerce Wholesale Lead Capture WordPress extension. Because the plugin trusts visitor-supplied file-type settings, an attacker can upload a PHP webshell via the public upload handler, leading to remote server access and full WordPress-site compromise.
A CVSS 9.8 critical unauthenticated arbitrary-file-upload vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin. Its publicly reachable AJAX upload handler accepts attacker-controlled allowed-file-type settings, allowing upload of PHP files and potential remote code execution and complete site compromise.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.