Threat Intelligence

Critical WooCommerce Plugin Flaw Lets Hackers Plant Backdoors on WordPress Sites

The Hacker News · 16 Sept 2026

Key Takeaway If your business runs a WordPress site with WooCommerce Wholesale Lead Capture, update the plugin immediately, check your uploads folder for unfamiliar PHP files, and review server logs for suspicious admin-ajax.php requests.

Security researchers at Wordfence have detected mass exploitation of a critical flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin used on more than 6,000 sites. The vulnerability, tracked as CVE-2026-27540 and rated 9.8 out of 10 in severity, allows unauthenticated attackers to upload arbitrary files, including malicious PHP scripts, without needing to log in.

The issue stems from missing file type checks in a plugin function called 'wwlc_file_upload_handler.' Attackers have been sending crafted requests to this function to upload a web shell disguised as 'shell.php,' which gives them remote access to the compromised site and lets them upload further malicious files through a browser-based form. Wordfence says it has blocked more than 100,000 exploit attempts since June 2026, with attacks continuing daily. The flaw affects all plugin versions up to and including 2.0.3.1.

Separately, Wordfence also flagged two critical vulnerabilities in The Events Calendar, a plugin installed on over 600,000 sites, which could similarly lead to remote code execution under certain configuration settings.

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.