Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin

1. Executive summary

A critical unauthenticated arbitrary file upload vulnerability in the premium WordPress plugin WooCommerce Wholesale Lead Capture (approx. 6,000 active installations) is being actively exploited in the wild, allowing unauthenticated attackers to write PHP webshells to a site and achieve remote code execution. The flaw is in the plugin's wwlc_file_upload_handler AJAX action, which reads its allowed-file-type list from an attacker-supplied request parameter, so a request that simply adds php to that list bypasses the extension filter. Wordfence reports blocking over 100,000 exploit attempts and states a patched version (2.0.3.2) is available. EMEA financial services exposure is confined to estates running this specific plugin — typically public-facing marketing, e-commerce or partner-portal WordPress sites — but where present, successful exploitation is full site compromise (webshell, rogue administrator accounts, data exfiltration). No CVSS vector, CVE identifier or CISA KEV status was available in the verified reference data for this item; the "critical" severity and active-exploitation claim are single-sourced to Wordfence and should be treated as such.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. This is a third-party software vulnerability disclosure, not an incident at a client; the generic facts that "a vulnerability exists", "patching is required" or "a third party is involved" do not by themselves trigger a reporting or testing obligation. A confirmed compromise of a client's own public-facing system via this flaw would at that point constitute an ICT-related incident and engage DORA Art. 17/18/19 — but that determination depends on the client's own incident, not on this advisory.

3. Technical analysis & attack chain

Affected component: WooCommerce Wholesale Lead Capture, a premium WordPress plugin providing a custom wholesale registration form with file-upload fields. Vulnerable up to and including the version preceding 2.0.3.2 (the patched release named by the source). No CVE identifier was provided in the source material.

Confirmed attack chain

1. The attacker sends an unauthenticated POST to /wp-admin/admin-ajax.php with the multipart field action=wwlc_file_upload_handler. The AJAX action is reachable by unauthenticated visitors.
2. The attacker supplies a forged file_settings parameter, e.g. {"allowed_file_types": ["php", "jpg"], "max_allowed_file_size": 99999999}.
3. The handler reads allowed_file_types directly from the request ($_REQUEST['file_settings']) rather than from the form's server-side configuration. Because the extension check (in_array($ext, $file_settings['allowed_file_types'])) relies on this attacker-controlled value, including php in the list passes the check. The handler also calls wp_handle_upload with 'test_type' => false, bypassing the MIME-type check, and 'test_form' => false.
4. The attacker uploads a file named shell.php (Content-Type: application/octet-stream). The handler renames it by stripping the extension and appending a Unix timestamp — i.e. shell-<unixtime>.php — before writing it via wp_handle_upload into a plugin-specific temp upload directory (set through the wwlc_set_temp_directory filter).
5. The attacker requests the written PHP file, which executes, yielding remote code execution.
6. The observed webshell (shell.php) echoes the string sohai, reports host details via php_uname(), and renders a browser-based upload form (name="uploader" / id="uploader") that copies a further uploaded file into place via copy($_FILES['file']['tmp_name'], $_FILES['file']['name']) — i.e. a self-contained file-drop capability for staging additional payloads.
7. Post-exploitation, the source states the access can be used to create administrator accounts, exfiltrate data, or take complete control of the site.

Observed exploitation activity (single-sourced, Wordfence): exploit attempts have been running for months, with notable clusters between 4–17 June 2026, and on 1 July and 30 August 2026. Wordfence reports >100,000 blocked attempts. The source references a list of "most actively engaged" source IP addresses, but those IP values were not included in the material provided to us and are therefore not reproduced here.

Firewall coverage timeline (Wordfence): a virtual-patch rule was delivered to Wordfence Premium/Care/Response customers on 27 February 2026, and to free-tier users 30 days later on 29 March 2026. The vulnerability was publicly disclosed 20 February 2026 and added to the Wordfence Intelligence database on 25 February 2026.

Confidence caveat: every technical and exploitation claim above derives from a single vendor (Wordfence). No independent corroboration, CVE record, CVSS vector or CISA KEV entry was available in the verified reference data. Verify against the plugin vendor's own advisory before relying on the version boundary or the exploitation timeline.

4. Mitigation & containment

P1 — within 24 hours

• Inventory: determine whether any WordPress estate runs WooCommerce Wholesale Lead Capture. Via WP-CLI: wp plugin list --status=active (plugin text domain is woocommerce-wholesale-lead-capture). Treat any install below 2.0.3.2 as exposed.
• Patch: update the plugin to 2.0.3.2 or later immediately. This is the vendor fix named by the source.
• If patching is not immediately possible: deactivate the plugin, or block the attack path at the edge — deny POST requests to /wp-admin/admin-ajax.php carrying action=wwlc_file_upload_handler (or a file_settings body containing php). Wordfence customers already have a virtual-patch rule (delivered 27 Feb 2026 / 29 Mar 2026 depending on tier).
• Hunt for webshells: search the uploads tree for recently created PHP files, especially shell.php and shell-<timestamp>.php: find wp-content/uploads -name "*.php" -mtime -180 -ls
• Log review: search web server access logs for POST /wp-admin/admin-ajax.php with the wwlc_file_upload_handler action. The source explicitly warns that the absence of such log entries does not prove the site is clean.

P2 — within 72 hours

• If any indicator of compromise is found: remove unexpected .php files, delete unknown administrator accounts, and review the site for additional backdoors.
• Rotate WordPress admin credentials, database credentials, salts/keys and any secrets reachable from the compromised host.
• Inspect uploaded PHP files for the webshell markers sohai, php_uname() and the uploader form (see §6).

P3 — within 7 days

• Harden the platform: block PHP execution inside wp-content/uploads (e.g. nginx location ~* /wp-content/uploads/.*\.php$ { deny all; }, or an equivalent Apache .htaccess rule), and enforce server-side allow-lists for upload types rather than request-supplied values.
• Fold third-party WordPress plugins into the software-component inventory so that premium-plugin vulnerabilities are tracked and patched on a defined cadence.

5. Indicators of compromise

No indicators of compromise available in the source material. The source references a set of "most actively engaged" source IP addresses, but those values were not present in the material provided and are not reproduced. No file hashes, domains or URLs were supplied.

Behavioural indicators

6. Detection

rule PHP_Webshell_WWLC_FileUpload
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-14"
        reference = "https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/"
        description = "Detects the PHP webshell dropped via the WooCommerce Wholesale Lead Capture unauthenticated arbitrary file upload vulnerability"
    strings:
        $sohai     = "sohai" ascii
        $uname     = "php_uname()" ascii
        $form_name = "name=\"uploader\"" ascii
        $form_id   = "id=\"uploader\"" ascii
        $action    = "wwlc_file_upload_handler" ascii
    condition:
        2 of them
}

title: WooCommerce Wholesale Lead Capture Unauthenticated File Upload Exploitation
id: 3b7f9c2e-5a41-4d8b-9e6f-1c2d3e4f5a6b
status: experimental
description: Detects POST requests to WordPress admin-ajax.php invoking the wwlc_file_upload_handler action used to exploit the WooCommerce Wholesale Lead Capture arbitrary file upload vulnerability.
author: Adverse Trace
date: 2026/09/14
references:

    - https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|endswith: '/wp-admin/admin-ajax.php'
    keywords:

        - 'wwlc_file_upload_handler'
        - 'allowed_file_types'
    condition: selection and keywords
fields:

    - c-ip
    - cs-uri-stem
    - cs-uri-query
falsepositives:

    - Legitimate authenticated wholesale-registration uploads that use the same AJAX action
level: high

7. Sources

• Wordfence — Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin — https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/ — 2026-09-14

8. Adverse Trace position

We assess this as a critical-severity, actively exploited vulnerability, but note that this assessment rests on a single source (Wordfence) — no verified reference data, CVE identifier, CVSS vector or CISA KEV entry was available for this item, so we do not present a numeric score or an authoritative exploitation state. Client impact is narrow but severe: it applies only to estates running WooCommerce Wholesale Lead Capture, and for those it is full site compromise via unauthenticated RCE. We will monitor for a CVE assignment and any plugin-vendor or independent advisory that corroborates the version boundary and exploitation timeline, and will reissue if the picture changes. Clients running the plugin should treat patching to 2.0.3.2 and the P1 hunt steps as immediate actions; clients that do not run it can close this advisory.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.