Critical Vulnerability in WooCommerce Plugin Exploited by Cybercriminals
Cyber attackers are leveraging a severe vulnerability within the WooCommerce Wholesale Lead Capture premium plugin for WordPress, enabling them to upload malicious PHP backdoors.
This security flaw, identified as CVE-2026-27540, adversely affects plugin versions 2.0.3.1 and earlier. The vulnerability represents an unauthenticated arbitrary file-upload weakness, first unveiled by cybersecurity researcher Teemu Saarentaus.
An adversary can capitalize on this flaw to upload PHP web shells and remotely execute code, ultimately risking the integrity and security of the entire website.
From a technical perspective, this vulnerability stems from the exposure of an unauthenticated AJAX action titled wwlc_file_upload_handler, which validates file extensions against an allowlist generated via the user-controlled file_settings request parameter.
This design enables malicious actors to add ‘php’ to the list of accepted file types, thus allowing the plugin to process uploads of PHP executable files.
The issue was rectified in version 2.0.3.2 of the WooCommerce Wholesale Lead Capture plugin, which was released on February 20.
Nonetheless, security firm Defiant has issued warnings, as its Wordfence web application firewall has thwarted over 100,000 exploit attempts connected to CVE-2026-27540.
According to Wordfence, incidents of exploitation surged between June 4 and June 17, and again on July 1 and August 30.
During these cyber incursions, attackers successfully uploaded a web shell that not only performs reconnaissance but also has the potential to implant further malicious payloads.
“The attacker submits a request to the wwlc_file_upload_handler AJAX action containing a manipulated file_settings parameter along with a malicious file featuring a .php extension,” Wordfence elaborates.
“The uploaded shell.php acts as a PHP web shell that reports host details and provides a browser-based upload form for deploying additional malicious files onto the site.”
Preventive Measures and Recommendations
Wordfence has issued a list of notorious IP addresses that have conducted tens of thousands of exploitation attempts. Administrators are urged to:
- Incorporate these IPs into a blocklist.
- Update the plugin to version 2.0.3.2 or later, which rectifies this security issue.
The researchers further recommend inspecting upload directories for unexpected or recently created PHP files.
Additionally, it is prudent to scrutinize logs for requests directed towards /wp-admin/admin-ajax.php invoking wwlc_file_upload_handler and to eliminate any unauthorized administrator accounts.
In the event of a confirmed compromise, it is advisable to restore the website from a secure backup, as the removal of all persistence mechanisms, users, and backdoors could prove to be an intricate process.
Join Mikko Hyppönen alongside security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit discussing the implications of AI-speed attacks, defensive strategies to reconsider, and methods for quick validation, decision-making, and rectification at machine speed.
Source link: Bleepingcomputer.com.
