From TechRadar · · 1m 20s
WooCommerce plugin exploited to backdoor WordPress sites
Hackers are actively exploiting a critical flaw in a popular wholesale plugin to upload malware and take over websites.
In brief
Hackers are actively exploiting a critical flaw in a popular wholesale plugin to upload malware and take over websites. If you use the Wholesale Lead Capture Plugin for WooCommerce, update to version 2.0.3.2 immediately and check your upload directories for suspicious PHP files. Originally reported by TechRadar.
Critical WooCommerce plugin under attack
Hackers are exploiting a flaw in the Wholesale Lead Capture Plugin to upload malware and take over WordPress sites. The plugin has over 20,000 active installations.
What the plugin does
The premium plugin costs $99 to $600 and adds wholesale customer registration for B2B businesses. It handles applications, user roles, and automated onboarding emails.
The vulnerability explained
CVE-2026-27540 lets unauthenticated attackers upload arbitrary files, including PHP webshells. It scores 9.0 out of 10 for severity, making it critical.
Patch available since February
Version 2.0.3.2 fixed the bug on February 20. Despite this, Wordfence blocked over 100,000 attacks in recent months.
Two major attack waves detected
Wordfence saw attack spikes from June 4 to 17 and July 1 to August 30. Attackers uploaded reconnaissance webshells to map sites before deploying serious malware.
“The uploaded shell.php is a PHP webshell that reports host details and provides a browser-based upload form for writing additional malicious files to the site”
What you need to do now
Update to the latest version immediately. Check your upload directories for unexpected or recently created PHP files that could be malicious.
What matters most
If you use the Wholesale Lead Capture Plugin for WooCommerce, update to version 2.0.3.2 immediately and check your upload directories for suspicious PHP files.
