Somewhere right now, a small business owner who runs a wholesale storefront on WordPress is checking their site because something looks off....
%20to%20plant%20PHP%20web%20shells%20on%20WordPress%20stores..webp "Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells")
Wordfence, the WordPress security company that first flagged the abuse, says it has already blocked over 100,000 exploit attempts against this flaw since June 2026, with 99 of those attempts logged in just the past 24 hours. If you run a store that depends on this plugin, that number is not a statistic. It is attackers, right now, trying the same door on your shop that they tried on someone else's an hour ago.
The vulnerability at fault is a broken file upload check
The flaw is tracked as CVE-2026-27540 and carries a CVSS score of 9.8, close to the maximum severity a vulnerability can reach. At its heart, this is a simple mistake with an outsized consequence: the plugin's AJAX action, named "wwlc_file_upload_handler," never properly checks what kind of file it is being asked to save. It affects every version of the plugin up to and including 2.0.3.1, and it does not require an attacker to be logged in.
Wordfence put it plainly: "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution." In everyday terms, that means someone with no account on your site, no password, and no relationship to your business can hand your server a file and have your server treat it as trustworthy. Once that happens, the attacker is no longer a stranger knocking. They are inside, with a working set of keys.
In the intrusions Wordfence has observed, attackers send a crafted request to that same "wwlc_file_upload_handler" action, forging a file_settings parameter and slipping in a malicious PHP file named "shell.php." It is a small, almost boring-sounding sequence of steps. What it buys the attacker is not boring at all.
What happens after the shell lands
Once the PHP file is on the server, it works like a web shell: a page an attacker can visit that reports back details about the host, and offers a browser-based upload form for writing further malicious files onto the site. From there, the attacker does not need to break in again. They already have a standing entrance, and they can use it to plant more tools, pivot to other parts of the server, or quietly wait.
This is not the only warning Wordfence has put out this week. The same research also detailed two critical flaws in The Events Calendar, a WordPress plugin installed on more than 600,000 sites, a reminder that this kind of exposure is not confined to one plugin or one storefront. It is a pattern across the ecosystem that wholesale and event-driven WooCommerce stores both depend on every day.
For the person running the shop, none of this shows up as a warning light. It shows up later, as a customer email that never should have gone out, a site that suddenly runs slow, or a call from a host asking why the server is behaving strangely. By the time it is visible, the shell has often already been sitting there for a while.
The plugin's maker has already shipped a fix: version 2.0.3.2 closes the file-upload gap that made all of this possible. If your store still runs anything at or below 2.0.3.1, that update is the one thing standing between your shop and the next 99 attempts in the next 24 hours.
Frequently Asked Questions
What is CVE-2026-27540?
It is the tracking number for a critical arbitrary file upload vulnerability in WooCommerce Wholesale Lead Capture, carrying a CVSS severity score of 9.8, that lets unauthenticated attackers upload PHP files to a vulnerable site.
Which plugin versions are affected?
All versions of WooCommerce Wholesale Lead Capture up to and including 2.0.3.1 are affected. Version 2.0.3.2 contains the fix.
Do attackers need a login to exploit this?
No. The flaw can be exploited by unauthenticated attackers, meaning anyone who can reach the site's AJAX endpoint, with no account or credentials needed.
How are attackers actually using this flaw?
Wordfence has observed attackers sending crafted requests to the plugin's "wwlc_file_upload_handler" action with a forged file_settings parameter to upload a malicious PHP file, effectively a web shell, onto the target site.
What does the planted PHP file do?
It functions as a web shell: it reports details about the compromised host back to the attacker and provides a browser-based form for uploading further malicious files to the site.
How many attacks has Wordfence tracked?
Wordfence said it has blocked over 100,000 exploit attempts against this vulnerability since June 2026, including 99 attempts in the 24 hours before its report.
What should site owners do right now?
Update WooCommerce Wholesale Lead Capture to version 2.0.3.2 or later immediately, and review server logs and file directories for any unfamiliar PHP files that may already have been planted.
%20to%20plant%20PHP%20web%20shells%20on%20WordPress%20stores..webp)
