MalwarePublished 15 Sep 2026

Hackers target WordPress sites via third-party WooCommerce plugin

Source Bleeping Computer

Mentions 1 CVE : update to 2.0.3.2

Mentioned vulnerabilities

CVE-2026-27540

Description

Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress to upload a PHP backdoor. [...]

Impact

Successful exploitation allows unauthenticated attackers to upload and execute arbitrary PHP code on affected WordPress sites, leading to potential full site compromise. Attackers can deploy webshells that perform reconnaissance and facilitate further malicious activities, including uploading additional payloads and creating persistence mechanisms. This poses a significant risk to the confidentiality, integrity, and availability of affected websites.

Defensive guidance

Upgrade the WooCommerce Wholesale Lead Capture plugin to version 2.0.3.2 or later, which addresses this vulnerability. Administrators should also review upload directories for unexpected or recently created PHP files, inspect logs for requests to /wp-admin/admin-ajax.php invoking the wwlc_file_upload_handler action, and remove any unknown administrator accounts. If a compromise is suspected, restoring the site from a known safe backup is recommended to fully remove backdoors and persistence mechanisms. Additionally, block high-offender IP addresses identified by Wordfence to reduce ongoing attack attempts.

References

bleepingcomputer.com/news/security/hackers-target-wordpress-sites-via-third-party-woocommerce-plugin/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 15 Sep 2026, 15:16 UTC

References

Community reviews

Related threats