Hackers are actively exploiting a critical WooCommerce plugin flaw to upload PHP backdoors to WordPress websites. Security researchers have recorded more than 100,000 attacks targeting vulnerable installations.
The security issue affects the premium WooCommerce Wholesale Lead Capture plugin. Successful exploitation can give attackers full control of a website.
Critical Vulnerability Enables File Uploads
The vulnerability, tracked as CVE-2026-27540, affects WooCommerce Wholesale Lead Capture version 2.0.3.1 and earlier.
Security researcher Teemu Saarentaus discovered the flaw. It allows an unauthenticated attacker to upload arbitrary files without logging into the targeted website.
Attackers can exploit the vulnerability to place PHP webshells on the server. They can then execute commands, inspect the hosting environment and upload additional malicious files.
Consequently, the attack may result in a complete WordPress site compromise.
User-Controlled Setting Bypasses File Restrictions
The WooCommerce plugin flaw affects an AJAX action called wwlc_file_upload_handler. This feature checks uploaded file extensions against an allowlist.
However, the plugin obtains that allowlist from the user-controlled file_settings request parameter. An attacker can therefore manipulate the setting and add PHP to the permitted file types.
The vulnerable plugin then accepts the executable file. Once the webshell reaches the server, the attacker can access it through a browser and continue the intrusion.
More Than 100,000 Attacks Detected
The plugin developer fixed the vulnerability in WooCommerce Wholesale Lead Capture version 2.0.3.2, released on February 20.
Despite the available update, many websites have remained vulnerable. WordPress security company Defiant reported that its Wordfence web application firewall blocked over 100,000 exploitation attempts connected to CVE-2026-27540.
Attack activity increased sharply between June 4 and June 17. Researchers also detected notable spikes on July 1 and August 30.
Several high-volume IP addresses generated tens of thousands of malicious requests. However, blocking those addresses alone may not provide lasting protection because attackers can switch to other servers.
Hackers Upload PHP Webshells
During observed attacks, hackers uploaded a file named shell.php. The webshell collected information about the compromised host and displayed an upload form through a browser.
This capability allows the attacker to write more malicious files to the website. Additional payloads could steal information, redirect visitors or establish persistent access.
Attackers may also create new administrator accounts or modify existing WordPress files. Therefore, deleting the first detected webshell may not remove every part of the compromise.
Administrators Should Update the Plugin
Website administrators should upgrade WooCommerce Wholesale Lead Capture to version 2.0.3.2 or later immediately. Any site running version 2.0.3.1 or older remains exposed.
Administrators should also inspect upload directories for unexpected PHP files, especially files created or modified recently.
Server logs may reveal requests to /wp-admin/admin-ajax.php that invoke the vulnerable wwlc_file_upload_handler action. Security teams should investigate these entries alongside unfamiliar IP addresses and unusual file activity.
Administrators must also check the WordPress user list for unknown accounts with elevated privileges. Attackers frequently create administrator accounts to retain access after defenders remove malicious files.
Updating Does Not Remove Existing Backdoors
Installing the patched plugin prevents future exploitation of this specific vulnerability. However, an update cannot remove webshells or other persistence mechanisms that attackers installed previously.
If administrators confirm a compromise, restoring the website from a verified clean backup may provide the safest recovery option. Manually removing malicious files can be difficult because attackers may hide several backdoors across the server.
After restoration, administrators should update WordPress, all plugins and themes before returning the website to service. They should also reset administrator, database, hosting and file-transfer credentials.
The campaign highlights the risks created by vulnerable third-party extensions. Prompt updates and continuous file monitoring can help prevent a single plugin flaw from leading to a complete WordPress takeover.
0 responses to “Hackers Exploit WooCommerce Plugin Flaw to Hijack WordPress Sites”