-
Threat actors are targeting a major security flaw in WooCommerce’s Wholesale Lead Capture plugin to attack WordPress websites.
-
Wordfence has blocked over 100,000 attacks from hackers, according to their recent report.
-
Site operators using this plugin on their site are recommended to update it and examine the site for any signs of unauthorized access.
The popular WooCommerce Wholesale Lead Capture plugin for WordPress websites has a security flaw that enables attackers to gain unauthorized access to sites.
The bug CVE-2026-27540 can allow someone who isn’t logged into a site to upload files to the website. This becomes problematic if the uploaded file has PHP code in it. Attackers will have a means to gain control over a compromised website through the use of such a file.
According to Defiant, the parent company of Wordfence, their firewall blocked over 100,000 exploitation attempts against the security hole. Despite the existence of a patch for the flaw, the attacks are still going on. These exploitation attempts occurred in waves. Wordfence noticed a lot more activity from June 4 to June 17, then more surges on July 1 and August 30.
Any site running older versions from 2.0.3.1 down is susceptible. Thankfully, version 2.0.3.2, released Feb. 20, 2026, has the fix. Credit goes to researcher Teemu Saarentaus for the discovery. This bug occupies the highest severity level of 9.8, according to WordFence’s score.
A Simple Upload Feature Created a Big Problem
The core of the issue is that the plugin itself does not treat file uploads correctly. Normally, WooCommerce Wholesale Lead Capture is designed to allow website owners to collect files from potential customers wanting to sign up for wholesale account access on their website. The plugin checks the type of each file before accepting it. That check, however, can be tricked.
A person trying to attack a site can send a modified request that changes the list of file types the plugin accepts. They can add PHP to that list. Once that happens, the site can accept a PHP file that should have been blocked.
That file can then run on the server. It is possible for the attacker to upload one file in order to run their own program through your website. All this happens due to a certain aspect of WordPress, which is called admin-ajax.php. Attackers target an action called wwlc_file_upload_handler to send the bad upload.
That may sound complicated, but the important point for site owners is simple: a stranger can send a dangerous PHP file without having a WordPress account.
Attackers Are Uploading Webshells
Wordfence says it has seen attackers use a file called shell.php during these attacks.
The file works as a backdoor. It can collect information about the server and also give the attacker a way to upload more files. It gathers details about the server and lets the attacker upload even more files.
Uploading that first file is just the start. Once the backdoor’s in place, the attacker can use it to drop more malware or mess up the site settings even more. A lot of things can happen once the attack is successful. An attacker might steal information, change pages, add an account, or try to keep access to the site.
WordPress attacks can also abuse legitimate website infrastructure to maintain access. In another recent case, hackers poisoned the BdThemes API to hijack WordPress websites through active administrator sessions, giving attackers another way to take control of compromised sites.
However, just because an attack gets blocked doesn’t mean the site was hacked. Wordfence blocking over 100,000 attacks is a big number. But it doesn’t mean the actual compromise of 100,000 sites.
The Attacks Have Come from Several IP Addresses
Wordfence has also identified several IP addresses that sent large numbers of attack requests. Some of the busiest addresses generated tens of thousands of attempts. One address sent more than 24,900 blocked requests, while another sent more than 24,000.
Other addresses also sent thousands of requests. This activity suggests that attackers are actively looking for websites that still have an old version of the plugin installed.
It also shows why fixing the problem matters. Once attackers know about a working way into a website, they can scan large numbers of sites looking for systems that have not been updated.
Update Addresses Another Serious Bug at the Same Time
WordPress version 2.0.3.2 is important also addresses another critical vulnerability in this plugin CVE-2026-27542.
The second vulnerability allows for gaining administrative privileges by a person who doesn’t have an account in this WordPress blog. The rating by Wordfence of this second vulnerability is 9.8 out of 10.
Both vulnerabilities are present in the versions up to 2.0.3.1 and have been resolved in version 2.0.3.2. Thus, those websites that don’t experience any file upload attacks also have a strong reason to upgrade their plugins.
What Website Owners Should Check?
Updating WooCommerce Wholesale Lead Capture should be the first step. Owners of websites should ensure that they are using at least version 2.0.3.2 or later versions, because newer versions are still available, and hence they do not have to stick with the security-fix version.
But updating alone is not enough. If an attacker already got into a site, installing the update will not automatically remove files they left behind.
Wordfence recommends looking through upload folders for PHP files that should not be there. Recently created files deserve extra attention, especially if nobody on the site remembers adding them.
Site owners should also check their server logs. Look for unusual requests involving admin-ajax.php and wwlc_file_upload_handler.
Unknown administrator accounts are another warning sign. If an account appeared without a clear reason, it should be investigated.
Wordfence has published IP addresses linked to the attacks. Blocking these addresses can certainly reduce the number of attacks, but it shouldn’t replace the plugin update
Notice any obvious signs of intrusion? Restore the website from the backup rather than delete all the files manually. Moreover, it’s important to search for any accounts the attackers may have created to get access to the site later on.
The main lesson is simple. WooCommerce Wholesale Lead Capture users should update their sites and then check for signs that someone has already tried to force their way in.
The security fix has been available since February, but Wordfence’s recent attack data shows that criminals are still looking for sites that have not installed it.
