# WooCommerce plugin exploited to backdoor WordPress sites

> Hackers are actively exploiting a critical flaw in a popular wholesale plugin to upload malware and take over websites.
- Title: WooCommerce plugin exploited to backdoor WordPress sites
- Summary: Hackers are actively exploiting a critical flaw in a popular wholesale plugin to upload malware and take over websites. If you use the Wholesale Lead Capture…
- Keywords: woocommerce, wordpress, wholesale lead capture plugin, cve-2026-27540, php backdoor, defiant, wordfence, file upload vulnerability, webshell, cybersecurity, malware, technology
- Source: TechRadar — https://techradar.com/pro/security/third-party-woocommerce-plugin-hits-wordpress-sites-with-php-backdoor-abusing-recently-patched-vulnerability
- Published: 2026-09-16T11:50:00+00:00
- Read time: 1 min
- Topics: woocommerce, wordpress, wholesale lead capture plugin, cve-2026-27540, php backdoor, defiant, wordfence, file upload vulnerability, webshell, cybersecurity, malware, technology
## Critical WooCommerce plugin under attack
Hackers are exploiting a flaw in the Wholesale Lead Capture Plugin to upload malware and take over WordPress sites. The plugin has over 20,000 active installations.
## What the plugin does
The premium plugin costs $99 to $600 and adds wholesale customer registration for B2B businesses. It handles applications, user roles, and automated onboarding emails.
## The vulnerability explained
CVE-2026-27540 lets unauthenticated attackers upload arbitrary files, including PHP webshells. It scores 9.0 out of 10 for severity, making it critical.
## Patch available since February
Version 2.0.3.2 fixed the bug on February 20. Despite this, Wordfence blocked over 100,000 attacks in recent months.
## Two major attack waves detected
Wordfence saw attack spikes from June 4 to 17 and July 1 to August 30. Attackers uploaded reconnaissance webshells to map sites before deploying serious malware.

> The uploaded shell.php is a PHP webshell that reports host details and provides a browser-based upload form for writing additional malicious files to the site
## What you need to do now
Update to the latest version immediately. Check your upload directories for unexpected or recently created PHP files that could be malicious.
## Key takeaway

If you use the Wholesale Lead Capture Plugin for WooCommerce, update to version 2.0.3.2 immediately and check your upload directories for suspicious PHP files.