# Critical WooCommerce Plugin Flaw Allows Remote Code Execution

*Published September 18, 2026*
*Source: [https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html](https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/critical-woocommerce-plugin-flaw-allows-remote-code-execution) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Cybercriminals are actively exploiting a significant vulnerability in WooCommerce Wholesale Lead Capture, a WordPress plugin used by over 6,000 websites. The flaw, identified as CVE-2026-27540 with a CVSS score of 9.8, allows unauthenticated attackers to upload arbitrary files, including PHP web shells, leading to potential remote code execution. According to Wordfence, a security firm specializing in WordPress, there have been more than 100,000 exploit attempts since June 2026, with a recent spike of 99 attempts in the last 24 hours.

The vulnerability stems from a lack of file type validation in the plugin's AJAX action named "wwlc_file_upload_handler". This loophole lets attackers upload arbitrary files to the server, facilitating remote code execution. Attackers have been observed using crafted requests with malicious PHP files to exploit this flaw. These files act as web shells, providing a browser-based interface for further malicious activities.

Site administrators are urged to scrutinize their servers for any unexpected .php files, especially in the uploads directory, and to monitor requests to "/wp-admin/admin-ajax.php" with the "wwlc_file_upload_handler" action parameter. Meanwhile, Wordfence has also detailed vulnerabilities in another popular WordPress plugin, The Events Calendar, which could also lead to remote code execution and site takeover. The developers have patched these issues in the latest plugin updates.

For WordPress site owners, vigilance is crucial to mitigate the risks posed by these vulnerabilities. Regular updates and thorough server checks can help prevent unauthorized access and potential data breaches.