CVE-2026-27540 is a critical vulnerability in the Woocommerce Wholesale Lead Capture plugin by Rymera Web Co Pty Ltd. It allows unrestricted upload of files with dangerous types, potentially enabling attackers to upload malicious files. This affects versions up to 2.0.3.1. The vulnerability has a high CVSS score of 9.0, indicating severe impact on confidentiality, integrity, and availability.