Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin

As cited

Copy frozen at 2026-09-14 20:02 UTC (site build).

vulnerabilities

Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin

An unauthenticated arbitrary file upload vulnerability (CVE-2026-27540) in the WooCommerce Wholesale Lead Capture plugin, affecting versions up to 2.0.3.1, allows attackers to upload PHP webshells and achieve remote code execution. Wordfence has blocked over 100,000 exploit attempts since the vulnerability's public disclosure on February 20, 2026, with active exploitation occurring across multiple attack campaigns. The plugin was patched in version 2.0.3.2, and affected WordPress sites should update immediately.

Why it matters: WordPress site operators using WooCommerce Wholesale Lead Capture (6,000+ active installations) face immediate risk of complete site compromise; patch to version 2.0.3.2 now and review uploads directories and web server logs for evidence of exploitation.

Source published

2026-09-14 18:49 UTC

First seen by Cybersecurity Tracker

2026-09-14 19:34 UTC