WordPress sites reportedly face active attacks through WooCommerce plugin flaw
SecurityUnverifiedUpdated:
WordPress sites running older versions of WooCommerce Wholesale Lead Capture reportedly remain under attack. Versions 2.0.3.1 and earlier are affected, while the reported fix is available in 2.0.3.2.
From unauthenticated uploads to PHP backdoors
BleepingComputer reports that attackers are actively exploiting CVE-2026-27540, an unauthenticated arbitrary file-upload flaw in the premium WooCommerce Wholesale Lead Capture plugin. The issue affects version 2.0.3.1 and older and can let an attacker upload a PHP webshell—a script that can provide remote control functions—and execute code on a site. Defiant's Wordfence web application firewall reportedly blocked over 100,000 attacks linked to the CVE. The plugin's version 2.0.3.2 addresses the issue.
The WooCommerce Wholesale Lead Capture vulnerability had been addressed in version 2.0.3.2, released on February 20.
A report now describes active exploitation of the flaw in older plugin versions, including attempts to upload PHP backdoors to WordPress sites.
The reported activity concerns a flaw that can turn a file-upload feature into code execution on affected WordPress sites, while a patched version is already available.
Sources
- BleepingComputerHackers target WordPress sites via third-party WooCommerce pluginRead source →