Unauthenticated arbitrary file upload in WooCommerce Wholesale Lead Capture plugin (CVE-2026-27540)
Wordfence reported on 2026-09-14 that attackers are actively exploiting this flaw against sites still on 2.0.3.1 or earlier, so an unpatched store can be turned into a webshell host by anyone scanning for it.
The Wholesale Lead Capture plugin for WooCommerce accepts file uploads of dangerous types from unauthenticated users in versions up to 2.0.3.1, allowing an attacker to place a PHP file (webshell) on the web server and take over the site.
Affected: WooCommerce Wholesale Lead Capture (Rymera Web Co) <= 2.0.3.1
How to Test
Check the plugin version on the WordPress Plugins page or via `wp plugin list`; anything at or below 2.0.3.1 is vulnerable. Look for compromise by searching the wp-content/uploads tree and the plugin directory for unexpected .php or double-extension files, reviewing web server logs for unauthenticated POST requests to the plugin's upload handling endpoints, and checking for new administrator users or modified core files.
How to Patch
Update WooCommerce Wholesale Lead Capture to 2.0.3.2 (the patched release identified by Patchstack). If the premium update cannot be obtained immediately, deactivate the plugin until it can.