> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin
- URL: https://f4n6.co.uk/security-feed/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/
- Published: 2026-09-14T19:21:08.000Z
- Updated: 2026-09-14T19:21:08.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

A critical unauthenticated arbitrary file upload vulnerability in the premium WordPress plugin **WooCommerce Wholesale Lead Capture** (approx. 6,000 active installations) is being actively exploited in the wild, allowing unauthenticated attackers to write PHP webshells to a site and achieve remote code execution. The flaw is in the plugin's `wwlc_file_upload_handler` AJAX action, which reads its allowed-file-type list from an attacker-supplied request parameter, so a request that simply adds `php` to that list bypasses the extension filter. Wordfence reports blocking over 100,000 exploit attempts and states a patched version (**2.0.3.2**) is available. EMEA financial services exposure is confined to estates running this specific plugin — typically public-facing marketing, e-commerce or partner-portal WordPress sites — but where present, successful exploitation is full site compromise (webshell, rogue administrator accounts, data exfiltration). **No CVSS vector, CVE identifier or CISA KEV status was available in the verified reference data for this item; the "critical" severity and active-exploitation claim are single-sourced to Wordfence and should be treated as such.**

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. This is a third-party software vulnerability disclosure, not an incident at a client; the generic facts that "a vulnerability exists", "patching is required" or "a third party is involved" do not by themselves trigger a reporting or testing obligation. A *confirmed compromise* of a client's own public-facing system via this flaw would at that point constitute an ICT-related incident and engage DORA Art. 17/18/19 — but that determination depends on the client's own incident, not on this advisory.

## 3\. Technical analysis & attack chain

**Affected component:** WooCommerce Wholesale Lead Capture, a premium WordPress plugin providing a custom wholesale registration form with file-upload fields. Vulnerable up to and including the version preceding **2.0.3.2** (the patched release named by the source). No CVE identifier was provided in the source material.

### Confirmed attack chain

1. The attacker sends an **unauthenticated** `POST` to `/wp-admin/admin-ajax.php` with the multipart field `action=wwlc_file_upload_handler`. The AJAX action is reachable by unauthenticated visitors.
2. The attacker supplies a forged `file_settings` parameter, e.g. `{"allowed_file_types": ["php", "jpg"], "max_allowed_file_size": 99999999}`.
3. The handler reads `allowed_file_types` directly from the request (`$_REQUEST['file_settings']`) rather than from the form's server-side configuration. Because the extension check (`in_array($ext, $file_settings['allowed_file_types'])`) relies on this attacker-controlled value, including `php` in the list passes the check. The handler also calls `wp_handle_upload` with `'test_type' => false`, bypassing the MIME-type check, and `'test_form' => false`.
4. The attacker uploads a file named `shell.php` (Content-Type: `application/octet-stream`). The handler renames it by stripping the extension and appending a Unix timestamp — i.e. `shell-<unixtime>.php` — before writing it via `wp_handle_upload` into a plugin-specific temp upload directory (set through the `wwlc_set_temp_directory` filter).
5. The attacker requests the written PHP file, which executes, yielding remote code execution.
6. The observed webshell (`shell.php`) echoes the string `sohai`, reports host details via `php_uname()`, and renders a browser-based upload form (`name="uploader"` / `id="uploader"`) that copies a further uploaded file into place via `copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])` — i.e. a self-contained file-drop capability for staging additional payloads.
7. Post-exploitation, the source states the access can be used to create administrator accounts, exfiltrate data, or take complete control of the site.

### Observed exploitation activity (single-sourced, Wordfence): **exploit attempts have been running for months, with notable clusters between** 4–17 June 2026**, and on** 1 July **and** 30 August 2026**. Wordfence reports >100,000 blocked attempts. The source references a list of "most actively engaged" source IP addresses, but** those IP values were not included in the material provided to us and are therefore not reproduced here.

**Firewall coverage timeline (Wordfence):** a virtual-patch rule was delivered to Wordfence Premium/Care/Response customers on **27 February 2026**, and to free-tier users 30 days later on **29 March 2026**. The vulnerability was publicly disclosed **20 February 2026** and added to the Wordfence Intelligence database on **25 February 2026**.

**Confidence caveat:** every technical and exploitation claim above derives from a single vendor (Wordfence). No independent corroboration, CVE record, CVSS vector or CISA KEV entry was available in the verified reference data. Verify against the plugin vendor's own advisory before relying on the version boundary or the exploitation timeline.

## 4\. Mitigation & containment

### P1 — within 24 hours

- **Inventory:** determine whether any WordPress estate runs WooCommerce Wholesale Lead Capture. Via WP-CLI: `wp plugin list --status=active` (plugin text domain is `woocommerce-wholesale-lead-capture`). Treat any install below **2.0.3.2** as exposed.
- **Patch:** update the plugin to **2.0.3.2** or later immediately. This is the vendor fix named by the source.
- **If patching is not immediately possible:** deactivate the plugin, or block the attack path at the edge — deny `POST` requests to `/wp-admin/admin-ajax.php` carrying `action=wwlc_file_upload_handler` (or a `file_settings` body containing `php`). Wordfence customers already have a virtual-patch rule (delivered 27 Feb 2026 / 29 Mar 2026 depending on tier).
- **Hunt for webshells:** search the uploads tree for recently created PHP files, especially `shell.php` and `shell-<timestamp>.php`: `find wp-content/uploads -name "*.php" -mtime -180 -ls`
- **Log review:** search web server access logs for `POST /wp-admin/admin-ajax.php` with the `wwlc_file_upload_handler` action. The source explicitly warns that the *absence* of such log entries does not prove the site is clean.

### P2 — within 72 hours

- If any indicator of compromise is found: remove unexpected `.php` files, delete unknown administrator accounts, and review the site for additional backdoors.
- Rotate WordPress admin credentials, database credentials, salts/keys and any secrets reachable from the compromised host.
- Inspect uploaded PHP files for the webshell markers `sohai`, `php_uname()` and the `uploader` form (see §6).

### P3 — within 7 days

- Harden the platform: block PHP execution inside `wp-content/uploads` (e.g. nginx `location ~* /wp-content/uploads/.*\.php$ { deny all; }`, or an equivalent Apache `.htaccess` rule), and enforce server-side allow-lists for upload types rather than request-supplied values.
- Fold third-party WordPress plugins into the software-component inventory so that premium-plugin vulnerabilities are tracked and patched on a defined cadence.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The source references a set of "most actively engaged" source IP addresses, but those values were not present in the material provided and are not reproduced. No file hashes, domains or URLs were supplied.

### Behavioural indicators

| Behaviour                                                                                          | Where to observe             | Confidence    |
| -------------------------------------------------------------------------------------------------- | ---------------------------- | ------------- |
| POST /wp-admin/admin-ajax.php with action=wwlc\_file\_upload\_handler                              | Web server access logs / WAF | High (source) |
| Request body containing file\_settings with php in allowed\_file\_types                            | WAF / request-body logging   | High (source) |
| Newly created .php files in the uploads directory, often named shell.php (or shell-<unixtime>.php) | File system / FIM            | High (source) |
| Uploaded PHP file echoing sohai and calling php\_uname()                                           | File content / HTTP response | High (source) |
| Uploaded PHP file rendering a browser upload form (name="uploader") that writes further files      | File content                 | High (source) |

## 6\. Detection

```yara
rule PHP_Webshell_WWLC_FileUpload
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-14"
        reference = "https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/"
        description = "Detects the PHP webshell dropped via the WooCommerce Wholesale Lead Capture unauthenticated arbitrary file upload vulnerability"
    strings:
        $sohai     = "sohai" ascii
        $uname     = "php_uname()" ascii
        $form_name = "name=\"uploader\"" ascii
        $form_id   = "id=\"uploader\"" ascii
        $action    = "wwlc_file_upload_handler" ascii
    condition:
        2 of them
}

```

```yaml
title: WooCommerce Wholesale Lead Capture Unauthenticated File Upload Exploitation
id: 3b7f9c2e-5a41-4d8b-9e6f-1c2d3e4f5a6b
status: experimental
description: Detects POST requests to WordPress admin-ajax.php invoking the wwlc_file_upload_handler action used to exploit the WooCommerce Wholesale Lead Capture arbitrary file upload vulnerability.
author: Adverse Trace
date: 2026/09/14
references:

    - https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|endswith: '/wp-admin/admin-ajax.php'
    keywords:

        - 'wwlc_file_upload_handler'
        - 'allowed_file_types'
    condition: selection and keywords
fields:

    - c-ip
    - cs-uri-stem
    - cs-uri-query
falsepositives:

    - Legitimate authenticated wholesale-registration uploads that use the same AJAX action
level: high

```

## 7\. Sources

- Wordfence — *Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin* — https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/ — 2026-09-14

## 8\. Adverse Trace position

We assess this as a **critical-severity, actively exploited** vulnerability, but note that this assessment rests on a **single source (Wordfence)** — no verified reference data, CVE identifier, CVSS vector or CISA KEV entry was available for this item, so we do not present a numeric score or an authoritative exploitation state. Client impact is narrow but severe: it applies only to estates running WooCommerce Wholesale Lead Capture, and for those it is full site compromise via unauthenticated RCE. We will monitor for a CVE assignment and any plugin-vendor or independent advisory that corroborates the version boundary and exploitation timeline, and will reissue if the picture changes. Clients running the plugin should treat patching to 2.0.3.2 and the P1 hunt steps as immediate actions; clients that do not run it can close this advisory.

---

[Read the original source →](https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*