WooCommerce plugin CVE-2026-27540: patched in February, hit now

A seven-month-old patch is not protection if nobody installed it. Attackers are actively exploiting CVE-2026-27540 in the WooCommerce Wholesale Lead Capture plugin to upload PHP webshells to WordPress stores, BleepingComputer reported on September 15. The fixed version — 2.0.3.2 — has been available since February 20, 2026. The campaign is still finding targets.

What actually happened

The flaw is an unauthenticated arbitrary file upload in the plugin's AJAX handler. The handler checks uploaded files against an extension allowlist, and an attacker can manipulate that allowlist — so a .php file gets through with no login and no user interaction. Rapid7's entry rates it 9.0 critical and lists every version through 2.0.3.1 as affected. Security researcher Teemu Saarentaus found it.

The payload in the wild is a file named shell.php — a webshell that reports host details and serves a browser-based upload form. That is not a data-theft smash-and-grab. That is a front door the attacker keeps.

Defiant's Wordfence division tracked the campaign and says its firewall has blocked over 100,000 attacks tied to this CVE, with volume spikes on June 4–17, July 1, and August 30. Note the shape of that: three separate waves, months apart, all after the patch. Somebody is re-scanning the same target list and still getting hits.

One detail matters more than the CVSS number. Wholesale Lead Capture is a premium plugin from Rymera — it is not distributed through the WordPress.org repository, so it does not ride the auto-update path most store owners assume covers everything. If your license lapsed, you are on 2.0.3.1 forever and your dashboard will not tell you.

Why this matters for your ecommerce business

Premium plugins are the gap in your patch story. Core WordPress updates itself. Repository plugins can auto-update. Paid plugins update through the vendor's own licence check — and that check fails silently when a card expires. Go look at your plugin list right now and sort by "last updated," not by name.

A webshell on a store is a payment problem, not just an IT problem. Code execution on the box that renders checkout is how card-skimming scripts get injected. If you take payments on your own domain, an attacker with shell.php is one edit away from your order flow.

The B2B signup form is a bigger target than it looks. Wholesale Lead Capture exists to let wholesale buyers register — which means it is deliberately reachable by unauthenticated visitors, on stores that by definition have a B2B side and real order values. The attackers picked it for a reason.

Checking is cheap. Confirm the plugin version is 2.0.3.2 or newer. Then search your uploads directory and web root for shell.php and any .php file in a directory that should only hold images. A patch closes the hole; it does not remove a shell that is already there.

Sources: BleepingComputer, Rapid7.