CVE-2026-27540 is an unauthenticated arbitrary file upload vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress, affecting versions 2.0.3.1 and earlier. The vulnerability arises from an exposed AJAX action (wwlc_file_upload_handler) that validates file extensions against a user-controlled allowlist via the file_settings parameter. Attackers can add 'php' to this allowlist, enabling the upload of PHP webshells. These webshells provide attackers with reconnaissance capabilities and a browser-based interface to upload additional malicious files, potentially leading to full site compromise. The issue was patched in version 2.0.3.2, released on February 20, 2026. Wordfence has reported over 100,000 blocked exploitation attempts and identified specific IP addresses involved in the attacks.

Successful exploitation allows unauthenticated attackers to upload and execute arbitrary PHP code on affected WordPress sites, leading to potential full site compromise. Attackers can deploy webshells that perform reconnaissance and facilitate further malicious activities, including uploading additional payloads and creating persistence mechanisms. This poses a significant risk to the confidentiality, integrity, and availability of affected websites.

Upgrade the WooCommerce Wholesale Lead Capture plugin to version 2.0.3.2 or later, which addresses this vulnerability. Administrators should also review upload directories for unexpected or recently created PHP files, inspect logs for requests to /wp-admin/admin-ajax.php invoking the wwlc_file_upload_handler action, and remove any unknown administrator accounts. If a compromise is suspected, restoring the site from a known safe backup is recommended to fully remove backdoors and persistence mechanisms. Additionally, block high-offender IP addresses identified by Wordfence to reduce ongoing attack attempts.