Hackers Exploit Critical WooCommerce Wholesale Lead Capture Flaw to Plant PHP Backdoors

Attackers Are Actively Backdooring WooCommerce Sites

Threat actors are actively exploiting a critical vulnerability in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with roughly 6,000 active installations, to upload PHP webshells and plant persistent backdoors on victim sites. Defiant, the company behind the Wordfence firewall, says it has blocked over 100,000 exploit attempts targeting the flaw, with exploitation spiking in waves for months after the bug was first disclosed.

The plugin lets WordPress store owners run a separate wholesale-registration workflow alongside a standard WooCommerce storefront — exactly the kind of public-facing, unauthenticated form submission that makes an unpatched file-upload flaw so dangerous.

Vulnerability Summary

How the Exploit Works

The vulnerability lives in an AJAX endpoint called wwlc_file_upload_handler, which is meant to accept only approved file types (images, PDFs, and similar) from visitors submitting wholesale-registration forms. The handler's flaw is that it trusts a file_settings parameter supplied directly in the incoming request to determine which file extensions are "allowed" — and it disables the plugin's normal file-type validation check while doing so.

Because the allowlist comes from attacker-controlled request data rather than a fixed server-side list, an unauthenticated visitor can:

• Submit a forged file_settings parameter that adds .php to the list of approved extensions
• Upload a malicious PHP file disguised as a legitimate form attachment
• Access the uploaded file directly through a browser to execute arbitrary code on the server

Wordfence describes the resulting webshells as functioning primarily as reconnaissance droppers — first-stage footholds that let attackers browse the compromised server and pull down additional payloads once they've confirmed access.

A companion flaw, CVE-2026-27542, compounds the risk: publicly circulating exploit tooling includes a mode that abuses a privilege-escalation bug in the same plugin to register a brand-new WordPress account with administrator rights, giving attackers a second, more durable path to full site control beyond the webshell itself.

Scale and Timing of the Attacks

• Wordfence's firewall recorded over 100,000 blocked exploit attempts against CVE-2026-27540 since disclosure
• Exploitation has come in sustained bursts rather than a single wave, with notable spikes between June 4–17, on July 1, and again on August 30, 2026
• The most aggressive sources identified were the IPs 92.241.13.213 and 31.59.129.150, each linked to more than 24,000 blocked requests, plus the IPv6 address 2a0f:85c1:840:5389::1 with more than 16,000 blocked requests
• The vulnerability was publicly disclosed and patched on February 20, 2026, meaning attackers have had months to build tooling and scan the web for unpatched installs

Potential Impact

A successful compromise gives an attacker code execution on the underlying web server, which on a live e-commerce site can mean:

• Theft of stored customer records and payment/financial data
• Injection of JavaScript payment skimmers into checkout pages
• Creation of rogue administrator accounts for long-term persistent access
• Use of the compromised site as further attack infrastructure (malware hosting, phishing pages, spam)

Remediation

For Site Administrators

1. Update immediately to WooCommerce Wholesale Lead Capture version 2.0.3.2 or later — this is the only complete fix.
2. Audit the uploads directory and other web-accessible folders for unexpected or recently created .php files.
3. Review web server logs for requests to /wp-admin/admin-ajax.php containing the wwlc_file_upload_handler action, and check for unfamiliar administrator accounts that may indicate CVE-2026-27542 was also exploited.
4. Block known high-offender IPs (92.241.13.213, 31.59.129.150, and the 2a0f:85c1:840:5389::1 range) at the firewall or WAF level as an added precaution.
5. Harden uploads directories by configuring the web server to deny execution of PHP or other executable files there, for example via a .htaccess rule that blocks script execution.
6. Restore from a known-clean backup if any indicators of compromise are found — do not assume a deleted webshell means the account/persistence mechanisms are also gone.

Given the volume and duration of exploitation, any site still running an unpatched version of this plugin should be treated as a likely target, not just a theoretical risk.

References

• Hackers target WordPress sites via third-party WooCommerce plugin — BleepingComputer

Related Reading

• WP2Shell' Opens Millions of WordPress Sites to Remote Takeover
• WP Maps Pro Bug Exploited to Create Admin Accounts on WordPress Sites
• WordPress Backup Plugin Flaw Exposes Millions of Sites to Takeover Attacks