Critical Vulnerability in WooCommerce Plugin Allows PHP Webshell Uploads
Cyber attackers are exploiting a significant vulnerability within a third-party WooCommerce plugin, facilitating the upload of PHP webshells to WordPress sites. This issue has arisen four months after the issuance of a patch designed to rectify it.
In a detailed analysis released on September 14, Wordfence reported that its firewall has thwarted over 100,000 attempts to exploit CVE-2026-27540 within the WooCommerce Wholesale Lead Capture plugin.
Developed by Rymera Web Co., this premium plugin boasts approximately 6,000 active installations. The vulnerability was made public and subsequently patched on February 20, under version 2.0.3.2.
Wordfence assigned the vulnerability a CVSS rating of 9.8, while Patchstack’s CVE record reflects a slightly lower score of 9.0, a disparity attributed to the perceived complexity of the attack. Data from Wordfence suggests that a single unauthenticated request can trigger the flaw.
Vulnerability Details: An Allowlist Accessible by Attackers
The compromised plugin features an AJAX action, wwlc_file_upload_handler, responsible for processing uploads from its wholesale registration form. Notably, this action is accessible to unauthenticated users.
This handler conducts extension validation against a predetermined list of acceptable file types. However, Wordfence discovered that the list is derived directly from the request rather than a verified server-side configuration.
Consequently, an unauthenticated attacker can manipulate this list to include PHP files, enabling the upload of executable files and transforming a benign file upload into a vulnerability for remote code execution.
Further compounding the risk, the code invokes WordPress’s upload function without rigorous type checking, allowing the extension validation to remain the sole line of defense against exploitation.
According to Wordfence, attackers have been transmitting meticulously constructed requests containing a counterfeit settings parameter alongside a PHP file, often labeled shell.php.
These resultant webshells can report host information and provide a web-based upload interface for further malicious file creations on the site.
Exploit attempts peaked between June 4 and June 17, with additional activity observed on July 1 and August 30. All versions from 2.0.3.1 and earlier are susceptible to this vulnerability. The flaw was reported by researcher Teemu Saarentaus.
For further insights regarding WordPress plugin vulnerabilities, consider reading: More Than 40,000 WordPress Sites Exposed to Authentication Bypass
Recommended Actions for Site Owners
It is imperative to update to version 2.0.3.2 or a subsequent release. While a firewall rule exists to mitigate known exploit attempts, it does not rectify the underlying vulnerability; thus, versions up to and including 2.0.3.1 are still at risk.
Wordfence recommends conducting a thorough review of the uploads directory for any unexpected or recently created PHP files, as well as examining web server access logs for requests to admin-ajax.php that involve the vulnerable action.
Those uncovering any anomalies should promptly remove suspicious files and unidentified administrator accounts, and conduct a comprehensive evaluation of the site for potential backdoors.
Wordfence also emphasized that a lack of corresponding log entries does not guarantee a site is secure.
Source link: Infosecurity-magazine.com.
