WordPress plugin flaw is being used to plant hidden backdoors on shop sites

Key points

• Attackers are actively exploiting CVE-2026-27540, a critical bug in the WooCommerce Wholesale Lead Capture plugin for WordPress, to plant hidden backdoors on shop websites.
• The flaw affects plugin versions 2.0.3.1 and older, and was fixed in version 2.0.3.2 released on 20 February.
• Wordfence, run by security firm Defiant, has blocked more than 100,000 attacks tied to this bug, with spikes between 4 and 17 June and again on 1 July and 30 August.
• No login is needed to exploit the flaw, and a successful attack gives criminals full control of the site.
• Site owners should update the plugin immediately, check upload folders for unknown PHP files, and remove any administrator accounts they do not recognise.

Hackers are breaking into WordPress shop sites through a paid plugin called WooCommerce Wholesale Lead Capture, using the hole to plant a backdoor that lets them run their own code.

The bug, tracked as CVE-2026-27540, was found by researcher Teemu Saarentaus. It lets anyone upload any file to the site without providing a username or password.

In practice that means uploading a webshell, a small malicious script that gives the attacker a control panel inside the victim's website.

What does the plugin do, and who uses it?

WooCommerce Wholesale Lead Capture is a premium add-on for WordPress shops that sell to other businesses. It sits on top of WooCommerce, the shopping software behind a large slice of the web's online stores, and collects sign-ups from potential wholesale customers.

Run a small B2B shop on WordPress with a wholesale application form, and there's a reasonable chance this plugin was doing the work behind it.

How are the attacks working?

The plugin trusted the browser to say which file types were allowed. There is a public web endpoint called wwlc_file_upload_handler that checks uploaded files against an allowed list of extensions, but the plugin reads that allowed list from a field in the same request the attacker controls.

The attacker sends a request that says, in effect, "PHP files are fine," attaches a PHP file, and the plugin accepts it. PHP is the programming language WordPress itself is built in, so once a PHP file lands on the server, the server will run it.

Wordfence, the security arm of Defiant, says the file it sees most often is a webshell called shell.php that reports server details and offers the attacker a browser form to upload further malicious files. It's the same basic playbook we reported on 3 September in the Elementor Pro exploitation wave: file-upload flaw, PHP webshell, immediate active exploitation.

How widespread is it?

BleepingComputer first reported Wordfence's figures: its web application firewall (a filter that sits in front of a website and blocks malicious requests) has blocked over 100,000 exploitation attempts against this one bug. Activity spiked between 4 and 17 June, then again on 1 July and 30 August.

What should site owners do right now?

Update the plugin to 2.0.3.2 or later today, then hunt for signs someone got in before you patched.

Wordfence's guidance is practical: look in your upload folders for PHP files that should not be there, especially recently created ones. Check your web server logs for requests to /wp-admin/admin-ajax.php that call wwlc_file_upload_handler. Delete any WordPress administrator accounts you do not recognise, and block the attacker IP addresses Wordfence has published.

If you find a real infection, don't try to clean it in place. Restore from a backup taken before the first suspicious upload. Webshells drop other webshells, and chasing them individually is how sites get reinfected a week later.

What about ordinary shoppers?

If a shop you've bought from runs on WordPress and got hit, the practical risk is the usual one after any website break-in: watch your card statement, and treat any email from the shop asking you to "reconfirm" payment details as suspect. Go directly to the shop's site rather than clicking a link.

A plugin that reads its own allowlist from the attacker's request is not a plugin. It's an upload form for criminals. Patch, then hunt.