---
title: "WooCommerce Wholesale Lead Capture Flaw Under Active Attack"
slug: "woocommerce-wholesale-lead-capture-file-upload-cve-2026-27540"
description: "Attackers are exploiting a WooCommerce Wholesale Lead Capture flaw to plant PHP webshells. Wordfence has blocked 100,000+ attempts. Check for a backdoor too."
date: 2026-09-15
author: "WP Vanguard Team"
category: "News"
tags: ["woocommerce-wholesale-lead-capture-vulnerability", "cve-2026-27540", "cve-2026-27542", "unauthenticated-file-upload", "privilege-escalation"]
featured_image: "/images/blog/woocommerce-wholesale-lead-capture-file-upload-cve-2026-27540.jpg"
---

Wordfence reported on September 14, 2026 that attackers are actively exploiting a WooCommerce Wholesale Lead Capture vulnerability, CVE-2026-27540, and that its firewall has already blocked more than 100,000 exploit attempts. The bug lets anyone upload a PHP file to the server without logging in. It was disclosed on February 20, 2026, and Wordfence's data shows attacks have been running for months, so a site that only updates today may already be carrying a webshell.

WooCommerce Wholesale Lead Capture (WWLC) is a premium plugin from Rymera Web Co, part of the Wholesale Suite bundle sold through wholesalesuiteplugin.com rather than the WordPress.org repository. Wordfence estimates about 6,000 active installations. That's small next to a plugin like UpdraftPlus, but every one of those sites is a no-login remote code execution target until it's patched.

## What CVE-2026-27540 and CVE-2026-27542 Actually Do

CVE-2026-27540 is an unrestricted file upload, tracked under CWE-434, in every WWLC version through 2.0.3.1. Wordfence scores it 9.8 Critical; Patchstack and NVD list it at 9.0. The plugin's wholesale registration form supports file upload fields, and the AJAX action behind them, `wwlc_file_upload_handler`, is reachable by visitors who aren't logged in.

The handler does check the file extension against a list of allowed types. The problem, per Wordfence's analysis, is where that list comes from: it's read from a `file_settings` parameter in the request itself, not from the form's saved configuration. An attacker sends their own settings with `php` in the allowed list, uploads `shell.php`, and the check waves it through. The webshell Wordfence captured in real attacks prints host details and adds a browser upload form for dropping more files.

CVE-2026-27542, the sibling, is a privilege escalation flaw tracked under CWE-266, Incorrect Privilege Assignment, and it does score 9.8 Critical on both Patchstack and NVD. It lives in the plugin's user-registration path. WWLC lets site visitors register as wholesale customers through a public form, and the registration handler didn't adequately restrict which fields a submitter could set. Public exploit code describes the result: a registration request that sets its own capabilities can create a full WordPress administrator account, with no login and no approval step.

Put together, the pairing is about as bad as it gets. An attacker doesn't need file upload and privilege escalation chained; either one alone gets full control. One drops a shell straight to disk, and the other mints an admin account on demand.

## The Vendor's Own Changelog Tells the Real Story

Rymera's published changelog for WWLC is unusually candid about what happened, and it's worth reading directly rather than taking a third party's word for it. Version 2.0.3.1, the last version NVD and Patchstack both list as vulnerable, actually shipped a line labeled "Bug Fix: Security: Unauthenticated arbitrary file upload in `wwlc_file_upload_handler()`." That's the same handler Wordfence's attack data shows being hit. The attempted fix in 2.0.3.1 didn't close the hole completely; both CVEs still cover it. The real fix landed in 2.0.3.2, described only as "security issue fixes and hardening."

The changelog doesn't stop there. Version 2.0.3.3 adds another line: "strengthened security checks around user role assignment during registration," plus general "additional various security hardening." That's the exact area CVE-2026-27542 lives in, patched again after the version Patchstack already lists as fixed. Version 2.0.3.4 then fixes a broken upload feature, a plausible side effect of tightening the upload handler two releases earlier. Current released version is 2.0.6.

That pattern, an initial partial fix, a real fix one version later, then more hardening in the same code paths across two more releases, is a sign the vendor kept finding more to close after the CVEs were assigned. If your site is sitting on exactly 2.0.3.2 because that's the version Patchstack lists as patched, you're on the version that stopped the CVE-scored bugs but missed follow-up hardening the vendor considered necessary anyway.

## Why "Actively Exploited" Changes What You Do Next

Wordfence's numbers show this isn't a fresh disclosure with theoretical risk. Its firewall blocked more than 100,000 exploit attempts after the February disclosure, with heavy waves between June 4 and June 17 and more spikes on July 1 and August 30. The busiest single source it names, 92.241.13.213, sent over 24,900 blocked requests on its own. Patchstack's database also marks both CVEs as known to be exploited.

There's a detail worth sitting with if you compare scoring systems. OpenCVE's EPSS score for both CVEs sits around 1.7%, a statistically low probability of exploitation. EPSS is a model trained across a huge population of CVEs, and it fits a small premium plugin badly. When a probability score and real attack telemetry disagree, believe the telemetry.

This is also why patching alone doesn't close the loop here the way it might for a vulnerability disclosed yesterday. If your site touched an unpatched version at any point during those seven months, the update fixes the hole going forward, but it does nothing about a webshell or a rogue admin account someone may have already planted through it.

## How to Check for a Backdoor or a Rogue Admin Account

Start with the version. If WWLC is installed, check what you're running:

```bash
wp plugin get woocommerce-wholesale-lead-capture --field=version
```

Anything at 2.0.3.1 or earlier was vulnerable to both CVEs the entire time it ran that version. Compare against 2.0.3.2 as the minimum patched release, and consider updating past it to 2.0.3.3 or later given the follow-up hardening described above.

Next, check who has administrator access on the site right now, and look for anything you don't recognize:

```bash
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
```

An admin account you didn't create, especially one registered around or after February 20, 2026, is exactly what CVE-2026-27542 produces. Cross-reference registration dates against your own memory of who you've onboarded; an unfamiliar username with a registration date inside the attack window deserves a closer look before you delete anything.

Then search for PHP where PHP shouldn't be, since that's what the upload bug plants. Wordfence says the files it saw were often named `shell.php`, but attackers can use any name:

```bash
# Any PHP file inside uploads is a red flag on its own
find wp-content/uploads -name '*.php' -type f

# PHP files anywhere under wp-content changed in the attack window
find wp-content -name '*.php' -newermt '2026-02-20' -type f
```

Your access logs are the other half of the story. Look for POST requests to `admin-ajax.php` carrying the upload action, and for the heaviest attacking IPs Wordfence published:

```bash
grep 'wwlc_file_upload_handler' /var/log/nginx/access.log*
grep -E '92\.241\.13\.213|31\.59\.129\.150|92\.241\.13\.140|23\.137\.105\.214' /var/log/nginx/access.log*
```

Adjust the log path for Apache or your host. The action name usually sits in the POST body, which most servers don't log, so a missing match doesn't clear the site; Wordfence makes the same point.

An empty result from any of these is reassuring but not proof of a clean site. If you find a PHP file in uploads or an unfamiliar admin account, don't just delete or demote it and move on. Our [guide to PHP backdoors in WordPress](/blog/php-backdoors-in-wordpress) covers what a dropped shell actually looks like and why attackers rarely leave just one way back in, and our [general checklist for signs a site has been hacked](/blog/signs-wordpress-site-hacked) walks through what else to check beyond the plugin that let someone in.

## What to Do Right Now

Update first, but don't stop there:

```bash
wp plugin update woocommerce-wholesale-lead-capture
```

If your site ran any version at or below 2.0.3.1 at any point since February 2026, treat this as a probable-compromise investigation, not a routine patch. Run the WP-CLI checks above. If you find a PHP file in uploads or an administrator account nobody on your team created, a proper cleanup goes further than deleting the one file you spotted; our [WordPress malware removal guide](/blog/wordpress-malware-removal-guide) covers what a real cleanup involves, including the persistence mechanisms attackers plant alongside the obvious shell.

The pattern here, unauthenticated file upload plus unauthenticated privilege escalation from a public-facing registration form, isn't unique to this plugin. We covered a structurally similar unauthenticated upload flaw, also actively exploited, in the [Super Forms nopriv AJAX vulnerability](/blog/super-forms-nopriv-ajax-file-upload-cve-2026-14894), and a matched pair of CVSS 9.8 privilege escalation bugs in a different product category in our [look at two WordPress themes with the same severity score](/blog/wordpress-theme-privilege-escalation-cvss-98). Public-facing forms that create user accounts or accept file uploads are a recurring soft spot, and it's worth checking any plugin on your site that does either.

[Run a scan on your site](/#scanner) to check your plugin versions against our vulnerability database.

## References

- [Wordfence: Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin](https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/)
- [Patchstack: WordPress Woocommerce Wholesale Lead Capture Plugin <= 2.0.3.1 - Arbitrary File Upload (CVE-2026-27540)](https://patchstack.com/database/wordpress/plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability)
- [Patchstack: WordPress Woocommerce Wholesale Lead Capture Plugin <= 2.0.3.1 - Privilege Escalation (CVE-2026-27542)](https://patchstack.com/database/wordpress/plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-privilege-escalation-vulnerability)
- [OpenCVE: CVE-2026-27540 Detail](https://app.opencve.io/cve/CVE-2026-27540)
- [OpenCVE: CVE-2026-27542 Detail](https://app.opencve.io/cve/CVE-2026-27542)
- [Wholesale Suite: WooCommerce Wholesale Lead Capture Changelog](https://wholesalesuiteplugin.com/woocommerce-wholesale-lead-capture-changelog/)