PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug

The cybersecurity landscape for WordPress administrators has grown increasingly precarious as threat actors pivot toward targeting legacy vulnerabilities in premium third-party plugins. Recent telemetry from the security firm Wordfence reveals a massive surge in exploitation attempts targeting CVE-2026-27540, a critical flaw residing within the WooCommerce Wholesale Lead Capture plugin developed by Rymera Web Co. Although a corrective patch was issued on February 20, 2026, to address this vulnerability, the persistence of unpatched installations—estimated at approximately 6,000 active sites—has provided a fertile hunting ground for automated attack scripts.

The Technical Anatomy of the Vulnerability

At the heart of this security failure lies an insecure implementation of an AJAX action handler, specifically identified as wwlc_file_upload_handler. Designed to facilitate the upload of documents through the plugin’s wholesale registration form, this function was intended to be a seamless user experience feature. However, it failed to implement the most basic tenets of secure coding practices regarding input validation.

Under normal conditions, an AJAX handler should validate file uploads against a server-side "allowlist"—a pre-defined set of permitted file extensions (such as .jpg, .pdf, or .docx) that the server is explicitly configured to accept. In the case of the Wholesale Lead Capture plugin, the handler instead drew its validation logic directly from the user-supplied request parameters.

This architectural oversight meant that an unauthenticated attacker could simply append "php" to the list of permitted file extensions during the upload process. Furthermore, the plugin code explicitly invoked WordPress’s internal upload functions with type-checking mechanisms disabled. By circumventing these controls, attackers were able to bypass the only remaining barrier, effectively turning a legitimate file upload portal into a gateway for Remote Code Execution (RCE). Once the PHP file—frequently disguised with names like shell.php—was successfully placed on the server, the attackers gained the ability to execute arbitrary code, manipulate databases, and exfiltrate sensitive customer data.

Chronology of the Exploitation Campaign

The timeline of this incident illustrates the widening gap between the disclosure of security vulnerabilities and the implementation of patches by site administrators.

• February 20, 2026: Rymera Web Co releases version 2.0.3.2 of the WooCommerce Wholesale Lead Capture plugin, containing the critical security fix for the arbitrary file upload vulnerability.
• Early June 2026: Researchers observe a significant uptick in automated scanning and exploitation attempts targeting the vulnerable wwlc_file_upload_handler action.
• June 4–17, 2026: The most intense period of malicious activity occurs. During these two weeks, firewall logs indicate thousands of attempts to upload malicious payloads.
• July 1, 2026: A secondary spike in activity is recorded, suggesting that threat actors were performing follow-up campaigns to hit sites that missed the initial wave.
• August 30, 2026: A third, notable wave of exploitation occurs, confirming that the vulnerability remains a high-priority target for automated botnets.
• September 14, 2026: Wordfence publishes a comprehensive technical analysis, noting that its web application firewall (WAF) has blocked more than 100,000 individual exploitation attempts since the campaign began.

Data-Driven Impact Analysis

The discrepancy in severity scoring between security organizations highlights the complexity of modern exploit assessment. Patchstack, which assigned the vulnerability a CVSS score of 9.0, focused on the potential for unauthorized access. Wordfence, however, rated the flaw at 9.8, citing the extreme ease of exploitation. Because the attack requires only a single, unauthenticated request to the server, the barrier to entry for attackers is virtually non-existent.

With approximately 6,000 active installations, the potential surface area for this attack is significant. While not all 6,000 sites are necessarily vulnerable—as many administrators likely updated to version 2.0.3.2—the sheer volume of 100,000 blocked requests suggests that attackers are performing wide-scale automated "spraying" of the internet, testing every WordPress installation they encounter for the presence of the outdated plugin.

Implications for WordPress Security

The ongoing exploitation of CVE-2026-27540 underscores a persistent challenge within the WordPress ecosystem: the "patch gap." While WordPress core updates are often automated, third-party premium plugins often rely on manual updates by site owners. When a developer releases a patch, it must be proactively installed by the site administrator; if they are unaware of the vulnerability or fail to monitor their plugin update notifications, their site remains exposed indefinitely.

The use of webshells is a particularly concerning outcome of this vulnerability. A webshell is not merely a single point of failure; it is a persistent backdoor. Once a webshell is uploaded, it provides the attacker with a browser-based interface to manage files, modify site configurations, and install additional malicious scripts, such as credit card skimmers or SEO spam injectors. Even if the plugin is eventually updated, the webshell often remains, granting the attacker continued access to the server long after the initial vulnerability has been closed.

Recommended Mitigation Strategies

For site owners currently using the WooCommerce Wholesale Lead Capture plugin, the priority is absolute: verify that the version installed is 2.0.3.2 or later. If the site is running any version 2.0.3.1 or earlier, it should be considered compromised until proven otherwise.

However, updating the plugin is only the first step. Because this vulnerability allows for the execution of arbitrary code, a simple update does not remove any malicious files already placed on the server by an attacker. Site administrators are urged to follow these forensic steps:

1. File System Audit: Manually inspect the /uploads/ directory and other common directories for suspicious PHP files. Attackers often rename files to blend in with legitimate media, so look for files with recent modification dates or obfuscated content.
2. Log Analysis: Review web server access logs for any requests to admin-ajax.php that include the wwlc_file_upload_handler action. Look for IP addresses that are not associated with legitimate administrative traffic.
3. Account Verification: Inspect the WordPress user table for unauthorized administrator accounts created during the timeframe of the vulnerability.
4. Integrity Checks: Use security plugins or file integrity monitoring tools to compare current site files against known-good copies from the WordPress repository or the plugin developer.

Wordfence has cautioned that the absence of malicious log entries does not constitute proof of a clean site. In many sophisticated attacks, the malicious actor may clear logs or use techniques to hide their tracks. Therefore, if any evidence of unauthorized access is found, the recommended course of action is to restore the site from a known-clean backup created prior to the first signs of suspicious activity and then immediately apply all outstanding security patches.

The persistence of CVE-2026-27540 serves as a stark reminder that in the interconnected world of e-commerce, the security of a single plugin is the security of the entire business. As attackers continue to refine their automation tools to target unpatched software, the burden of security falls increasingly on the shoulders of site owners who must balance operational convenience with rigorous, ongoing maintenance.