CYBERSECURITYTRACKER
Permanent story citation

Hackers target WordPress sites via third-party WooCommerce plugin

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 7366

As cited

Copy frozen at (site build).

vulnerabilities

Hackers target WordPress sites via third-party WooCommerce plugin

Attackers are exploiting a critical flaw in the WooCommerce Wholesale Lead Capture plugin for WordPress to install malicious PHP code on vulnerable sites. The vulnerability allows remote code execution without requiring authentication, providing hackers with persistent access to affected installations.

Why it matters: WordPress site operators using the Wholesale Lead Capture plugin face immediate risk of website compromise and data theft; patching or disabling the plugin should be prioritized.

VendorsWordPress
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary