The vulnerability CVE-2026-27540 in the Woocommerce Wholesale Lead Capture plugin permits unrestricted upload of files with dangerous types, which can be exploited by attackers to upload malicious files. This affects all versions up to 2.0.3.1. The CVSS 3.1 score is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating network attack vector, high attack complexity, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker to upload and execute malicious files on the affected system, leading to full compromise of confidentiality, integrity, and availability of the affected environment. Given the critical CVSS score, the impact is severe. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions and validate file types on the server side as a temporary mitigation. Monitor for updates from Rymera Web Co Pty Ltd. regarding official patches or fixes.