Executive Summary
A critical security vulnerability has been identified in the WooCommerce Wholesale Lead Capture plugin, a widely deployed extension for WordPress e-commerce platforms. This flaw enables unauthenticated attackers to upload arbitrary files, including malicious PHP web shells, directly to the server. The exploitation of this vulnerability grants adversaries persistent remote access, allowing them to execute arbitrary commands, escalate privileges, exfiltrate sensitive data, and potentially deploy additional malware. Multiple security vendors and threat intelligence sources have confirmed active exploitation in the wild, with public proof-of-concept code accelerating the threat landscape. Organizations utilizing the WooCommerce Wholesale Lead Capture plugin are strongly urged to take immediate remediation actions to mitigate the risk of compromise.
Threat Actor Profile
Current intelligence indicates that the exploitation of the WooCommerce Wholesale Lead Capture vulnerability is being conducted by a broad spectrum of threat actors. While no specific Advanced Persistent Threat (APT) group attribution has been made public, the tactics, techniques, and procedures (TTPs) observed are consistent with those employed by financially motivated cybercriminals and ransomware operators. Open-source intelligence (OSINT) reveals that web shells planted via this vulnerability are being actively traded and sold on underground forums, suggesting a commoditization of access. The attacks are opportunistic and automated, targeting any vulnerable installation globally, with a particular focus on e-commerce and retail sectors that rely on WordPress and WooCommerce for business operations.
Technical Analysis of Malware/TTPs
The vulnerability in WooCommerce Wholesale Lead Capture arises from insufficient validation in the plugin’s file upload functionality. Specifically, the plugin registers an AJAX handler (wwlc_file_upload_handler) without proper authentication or nonce verification, exposing it to unauthenticated file upload attacks. Attackers craft multipart HTTP POST requests to the /wp-admin/admin-ajax.php endpoint, specifying the vulnerable action parameter. This allows the upload of arbitrary files, including PHP scripts, into the wp-content/uploads/wwlc-temp-* directories, which are publicly accessible and executable by the web server.
Once a PHP web shell is uploaded, the attacker can access it via a browser, providing a command-and-control interface for executing system commands, uploading additional payloads, and manipulating the server environment. Common web shell signatures, such as Nx_SHELL_SIGNATURE, have been observed in the wild. Attackers may further brute-force or enumerate the dynamically generated upload directories to locate and interact with their web shells.
The attack chain typically involves reconnaissance to identify vulnerable sites, exploitation via crafted POST requests, establishment of persistence through web shells, and post-exploitation activities such as privilege escalation, lateral movement, data exfiltration, and deployment of ransomware or other malware. The MITRE ATT&CK framework maps this activity to T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter), T1505 (Server Software Component), T1036 (Masquerading), T1499 (Endpoint Denial of Service), and T1486 (Data Encrypted for Impact).
Exploitation in the Wild
Active exploitation of the WooCommerce Wholesale Lead Capture vulnerability has been confirmed by multiple security vendors, including Wordfence and Patchstack. Since the public disclosure of the flaw, over 100,000 exploit attempts have been blocked, with attacks originating from a diverse set of IP addresses. Proof-of-concept exploit code is readily available on platforms such as GitHub and Exploit-DB, lowering the barrier to entry for less sophisticated attackers.
Reports from The Hacker News, LinkedIn, and Reddit indicate that threat actors are scanning for and exploiting this vulnerability at scale. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities Catalog, underscoring the urgency of remediation. Web shells deployed via this vector are being monetized on underground forums, further incentivizing widespread exploitation.
Victimology and Targeting
The primary victims of this campaign are organizations operating WordPress sites with the WooCommerce Wholesale Lead Capture plugin enabled. This includes e-commerce businesses, retail operations, and small to medium-sized enterprises (SMBs) that rely on WooCommerce for wholesale customer management. The attacks are global in scope, with no evidence of targeted campaigns against specific countries or sectors. Instead, automated scanning and exploitation tools are being used to identify and compromise any vulnerable installation, regardless of geographic location or industry vertical.
Indicators of compromise (IOCs) include the presence of unexpected .php files in wp-content/uploads/wwlc-temp-* directories, suspicious POST requests to /wp-admin/admin-ajax.php?action=wwlc_file_upload_handler, and access logs showing connections from known malicious IP addresses such as 92.241.13.213, 31.59.129.150, 2a0f:85c1:840:5389::1, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, and 37.114.144.209.
Mitigation and Countermeasures
Immediate action is required to mitigate the risk posed by this vulnerability. Organizations should upgrade the WooCommerce Wholesale Lead Capture plugin to the latest patched version as released by the vendor. If the plugin is not essential to business operations, it should be disabled or removed entirely. Administrators must conduct a thorough review of the wp-content/uploads/wwlc-temp-* directories and other upload locations for unauthorized .php files, removing any that are not legitimate.
Web server logs should be scrutinized for suspicious POST requests to the vulnerable AJAX endpoint and for access from the aforementioned malicious IP addresses. Implementing a web application firewall (WAF) can help block malicious file uploads and detect anomalous traffic patterns. Additionally, restricting execution permissions in upload directories can prevent the execution of uploaded PHP scripts, adding an extra layer of defense.
Organizations are encouraged to follow best practices for securing WordPress environments, including regular plugin updates, principle of least privilege for file and directory permissions, and continuous monitoring for indicators of compromise. Incident response plans should be updated to include detection and remediation steps for web shell activity.
References
Vendor Advisory and Patch Information: Please refer to the official WooCommerce Wholesale Lead Capture plugin page on the WordPress repository for the latest security updates and patch notes.
NVD Entry for CVE: Search the National Vulnerability Database for the assigned CVE identifier related to this vulnerability.
CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
LinkedIn Security Community Discussions: Search LinkedIn for recent posts on WooCommerce Wholesale Lead Capture exploit.
Reddit r/netsec Thread: Search Reddit for “WooCommerce Wholesale Lead Capture web shell”.
Exploit-DB PoC: Search Exploit-DB for WooCommerce Wholesale Lead Capture.
The Hacker News: https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html
Wordfence Blog: https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/
GitHub PoC: https://github.com/Nxploited/CVE-2026-27542-CVE-2026-27540-
SentinelOne CVE-2026-27540: https://www.sentinelone.com/vulnerability-database/cve-2026-27540/
Patchstack Vulnerability Advisory: https://patchstack.com/database/vulnerability/woocommerce-wholesale-lead-capture/
About Rescana
Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their digital supply chain. Our advanced analytics and threat intelligence capabilities empower security teams to proactively identify vulnerabilities, prioritize remediation, and ensure compliance with industry standards. For more information about how Rescana can help safeguard your organization’s digital ecosystem, or if you have questions regarding this advisory, please contact us at info@rescana.com.
