Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

WooCommerce Wholesale Lead Capture plugin 2.0.3.2 security update (CVE-2026-27540)

Security Patch Release
First reported
Last updated
Happening score
H score 9
3 unique sources, 3 articles

Summary

Hide ▲

The WooCommerce Wholesale Lead Capture plugin's version 2.0.3.2 release closed CVE-2026-27540, an unauthenticated arbitrary file-upload flaw that let attackers upload PHP webshells to WordPress sites. The update covered version 2.0.3.1 and older and landed on February 20. Site operators were told to upgrade to 2.0.3.2 or later and look for suspicious /wp-admin/admin-ajax.php activity and unexpected PHP files.

Related Happenings

Elementor CSRF bypass mitigation (4.3.2)

Advisory/Mitigation
H score83 First: 25.09.2026 21:13 Last: 25.09.2026 21:13 Sources 1

About this happening: Elementor users are being told to upgrade to version 4.3.2 immediately to block a CSRF bypass that can let a logged-in administrator perform attacker-triggered REST AP...

Open Happening

Elementor plugin for WordPress security fix in 4.3.2

Security Patch Release
H score30 First: 25.09.2026 21:13 Last: 25.09.2026 21:13 Sources 1

About this happening: The Elementor team shipped version 4.3.2 of the Elementor plugin for WordPress to fix a CSRF flaw that could let attackers create administrator accounts on vul...

Open Happening

WordPress security patch release for CVE-2026-87902

Security Patch Release
H score47 First: 23.09.2026 21:31 Last: 23.09.2026 21:31 Sources 1

About this happening: WordPress released version 7.1.2 to fix CVE-2026-87902, a critical unauthenticated path traversal flaw that can lead to remote code execution under specific co...

Open Happening

WordPress core security release (7.1.1)

Security Patch Release
H score45 First: 18.09.2026 19:56 Last: 18.09.2026 19:56 Sources 1

About this happening: WordPress 7.1.1 is a security release that fixed the Click2Shell WordPress Core flaw, a CSRF issue that could let a logged-in administrator open a crafted...

Open Happening

WooCommerce Wholesale Lead Capture CVE-2026-27540 exploitation wave

Exploitation Wave
H score16 First: 15.09.2026 17:45 Last: 15.09.2026 17:45 Sources 1

How related: The WordPress security company said it has blocked over 100,000 exploit attempts targeting the vulnerability since June 2026, with 99 of those attack attempts recorded over the past 24 hours.

About this happening: CVE-2026-27540 exploitation against WooCommerce Wholesale Lead Capture is driving repeated spikes and more than 100,000 blocked attacks, putting WordPress sites at ris...

Open Happening

Timeline

  1. 15.09.2026 17:45 4 articles · 13d ago

    WooCommerce Wholesale Lead Capture 2.0.3.2 closes CVE-2026-27540

    Mitigation Patch Update

    WooCommerce Wholesale Lead Capture version 2.0.3.2 was released on February 20, 2026 to fix CVE-2026-27540, an unauthenticated arbitrary file-upload flaw in version 2.0.3.1 and older. The issue exposed the `wwlc_file_upload_handler` AJAX action and let a user-controlled `file_settings` parameter admit `.php` uploads, enabling PHP webshell upload and code execution; administrators were advised to upgrade to 2.0.3.2 or later.

    Show sources
    Open in new tab
  2. 15.09.2026 17:45 1 articles · 13d ago

    Wordfence warns of active CVE-2026-27540 exploitation against WooCommerce Wholesale Lead Capture

    Initial Disclosure

    Wordfence warned that hackers are actively exploiting CVE-2026-27540 in the WooCommerce Wholesale Lead Capture premium plugin for WordPress, using a forged `file_settings` value and a malicious `.php` upload through `wwlc_file_upload_handler` to place a PHP webshell that can report host details, support reconnaissance, and write additional malicious files. Wordfence said its firewall blocked over 100,000 attacks and noted exploitation spikes between June 4 and June 17, as well as on July 1 and August 30.

    Show sources
    Open in new tab