Skip to content
Today
Sections

Security Reports disagree3 publishers 3 min read Published Updated

Wordfence blocked 100,000 exploit attempts against a WooCommerce plugin with 6,000 installs

CVE-2026-27540 lets an unauthenticated request add php to the plugin's own upload allowlist and drop a webshell. The fix shipped on February 20, and the first exploitation spike came 104 days later, on June 4.

The Watch · Security desk

Send a correction

Illustration accompanying Wordfence blocked 100,000 exploit attempts against a WooCommerce plugin with 6,000 installs
Generated illustration

What happened

  • CVE-2026-27540 lets an unauthenticated attacker upload arbitrary files, including PHP, to sites running WooCommerce Wholesale Lead Capture 2.0.3.1 or earlier, a premium plugin with more than 6,000 active installs.
  • Wordfence says it has blocked more than 100,000 attempts against the flaw since June 2026, with activity spiking from June 4 to June 17 and again on July 1 and August 30.
  • The file the attackers upload is shell.php, a webshell that reports host details and serves a browser-based form for writing further malicious files to the site.
  • The developer fixed the flaw in version 2.0.3.2, released on February 20, and Wordfence tells administrators to move to that release or later.
  • Wordfence separately detailed two unauthenticated remote code execution chains in The Events Calendar, a plugin on more than 600,000 sites, patched by StellarWP in 6.17.3.1 and 6.17.4.1.

Why it matters

  • What it sets up precedent A premium plugin on 6,000 sites drew about 17 blocked requests per install, so install count is no longer a useful way to rank which plugins in a hosting estate get probed first.
  • What's now possible capability One successful upload gives the attacker a file-drop channel of his own, so patching or deleting the plugin after June does not take back the access.
  • Who has to decide decision Wordfence's remediation for a confirmed hit is a restore from a safe backup, which leaves operators without a clean pre-June copy facing a rebuild.
  • Who's exposed exposure The Events Calendar risk gates on a setting, so among 600,000 installs only the sites that display comments on event pages need the emergency update.

The plugin asks the client which file extensions to trust. According to Wordfence, the AJAX action wwlc_file_upload_handler checks an uploaded file's extension against an allowlist carried in the file_settings request parameter, and the requester supplies that parameter [2]. Add php to the list and the plugin accepts a PHP file. "The attacker submits a request to the wwlc_file_upload_handler AJAX action containing a forged file_settings parameter and a malicious file with a .php extension," Wordfence said [3]. Security researcher Teemu Saarentaus found the flaw [8].

The gap between the fix and the first recorded spike is 104 days [18]. So the population at risk is narrow and identifiable: sites still running 2.0.3.1 or older between June 4 and August 30 [10].

More than 100,000 blocked attempts against a plugin with more than 6,000 active installs works out at roughly 17 blocked requests per install [19]. Wordfence's figure counts requests its firewall blocked across the sites it protects, and neither writeup says how many of those sites had the plugin installed. A ratio like that comes from scanners that fire the request at every host and read the response to learn which ones run the plugin.

Wordfence recorded 99 attempts in the 24 hours before publication [6]. Across the 87 days from June 4 to August 30, 100,000 blocked requests average about 1,150 a day [20].

For a site that was exposed in that window, the check is on disk and in logs: unexpected or recently created .php files in the uploads directory, and requests to /wp-admin/admin-ajax.php with the action parameter set to wwlc_file_upload_handler [12]. Wordfence also says to remove administrator accounts you do not recognise [12]. It published ten high-offender addresses, among them 92.241.13.213 and the IPv6 host 2a0f:85c1:840:5389::1 [11]. Where compromise is confirmed, Defiant's advice is to restore from a safe backup, because removing every persistence mechanism, user and backdoor may be complicated [13].

The same writeup covers The Events Calendar, on more than 600,000 sites [14]. CVE-2026-78159 sits in the parse_array validation of a widget classes map and affects versions up to 6.17.3; CVE-2026-78006 sits in is_safe_widget_instance and affects versions up to 6.17.4 [15][16]. Exploitation needs comments enabled on the target event page and the plugin's "Show comments on event pages" option active [21], and Wordfence says both chains can be triggered through WordPress's pending-comment preview without moderator approval [22]. The 100,000 blocked requests belong to the lead capture flaw.

"The first chain uses PHP Object Injection to execute arbitrary operating system commands on the underlying server. The second chain bypasses the object-injection guard and abuses an arbitrary-callable primitive to reset an administrator's password, after which an attacker can upload a malicious plugin and take complete control of the site," Wordfence said [23].

What to watch

  • Whether Wordfence records exploitation of CVE-2026-78159 or CVE-2026-78006 in the wild, which would put the same payload delivery against 600,000 installs instead of 6,000.
  • Whether the shell.php operators come back to the hosts they took in June with something beyond reconnaissance, or sell the access on.
  • A fourth attempt spike after August 30, which would mean the scanners are still finding hosts on 2.0.3.1 worth revisiting.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence60
Adoption20
Hype gap+15
Incentives45
Confidence65

Perspective Coverage

3 publishers
Builder
Builder 33%
Operator
Operator 57%
Investor
Investor 10%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    The flaw is an arbitrary file upload caused by missing file type validation in an AJAX action named wwlc_file_upload_handler, affecting all plugin versions up to and including 2.0.3.1, and allows an unauthenticated attacker to upload files and achieve remote code execution.

    Reported SupportedView cited source
  2. [2]

    The unauthenticated wwlc_file_upload_handler AJAX action checks file extensions against an allowlist supplied through the user-controlled file_settings request parameter, which allows adding 'php' to the permitted file types so the plugin accepts PHP uploads.

    Reported SupportedView cited source
  3. [3]

    "The attacker submits a request to the wwlc_file_upload_handler AJAX action containing a forged file_settings parameter and a malicious file with a .php extension," Wordfence said.

    Reported SupportedView cited source
  4. [4]

    The uploaded PHP file, shell.php, is a web shell that reports host details and offers a browser-based upload form for writing additional malicious files to the compromised WordPress site.

    Reported SupportedView cited source
  5. [5]

    Wordfence says it has blocked over 100,000 exploit attempts targeting CVE-2026-27540 since June 2026.

    Reported SupportedView cited source
  6. [6]

    Wordfence recorded 99 of the attack attempts over the past 24 hours.

    Reported SupportedView cited source
  7. [7]

    WooCommerce Wholesale Lead Capture is a premium WordPress plugin with more than 6,000 active installs.

    Reported SupportedView cited source
  8. [8]

    The unauthenticated arbitrary file-upload vulnerability was discovered by security researcher Teemu Saarentaus.

    Reported SupportedView cited source
  9. [9]

    The vulnerability was addressed in version 2.0.3.2 of the WooCommerce Wholesale Lead Capture plugin, released on February 20, and administrators are advised to upgrade to 2.0.3.2 or later.

    Reported SupportedView cited source
  10. [10]

    Wordfence reports that exploitation activity spiked between June 4 and June 17, and on July 1 and August 30.

    Reported SupportedView cited source
  11. [11]

    Wordfence published ten high-offender IP addresses used in the attacks, including 92.241.13.213, 31.59.129.150, 2a0f:85c1:840:5389::1 and 37.114.144.209, and recommends blocklisting them.

    Reported SupportedView cited source
  12. [12]

    Wordfence advises checking upload directories for unexpected or recently created PHP files, examining logs for requests to /wp-admin/admin-ajax.php invoking wwlc_file_upload_handler, and removing unknown administrator accounts.

    Reported SupportedView cited source
  13. [13]

    If compromise is confirmed, the recommended action is to restore the website from a safe backup, as removing all persistence mechanisms, users and backdoors may be complicated.

    Reported SupportedView cited source
  14. [14]

    Wordfence detailed two critical flaws in The Events Calendar, a WordPress plugin installed on over 600,000 websites.

    Reported SupportedView cited source
  15. [15]

    CVE-2026-78159 (CVSS 9.8) arises from insufficient validation of the widget 'classes' map in the parse_array function and can be exploited for unauthenticated remote code execution in versions up to 6.17.3.

    Reported SupportedView cited source
  16. [16]

    CVE-2026-78006 (CVSS 9.8) arises from insufficient protection in the is_safe_widget_instance function and can be exploited for unauthenticated remote code execution in versions up to 6.17.4.

    Reported SupportedView cited source
  17. [17]

    StellarWP, which develops The Events Calendar, addressed the two flaws in versions 6.17.3.1 and 6.17.4.1 respectively.

    Reported SupportedView cited source
  18. [18]

    104 days separate the February 20 release of the fixed version and the June 4 start of the first exploitation spike.

    Derived Supported
  19. [19]

    More than 100,000 blocked attempts against a plugin with more than 6,000 active installs is roughly 17 blocked requests per active install.

    Derived Supported
  20. [20]

    Across the 87 days from June 4 to August 30, 100,000 blocked requests average about 1,150 a day.

    Derived Supported
  21. [21]

    Successful exploitation of The Events Calendar flaws requires the target event page to have comments enabled and the plugin's "Show comments on event pages" option to be active.

    Reported SupportedView cited source
  22. [22]

    Wordfence warned that both Events Calendar chains can be triggered through WordPress's pending-comment preview without moderator approval, and could lead to complete site takeover, sensitive data theft and malware deployment.

    Reported SupportedView cited source
  23. [23]

    "The first chain uses PHP Object Injection to execute arbitrary operating system commands on the underlying server. The second chain bypasses the object-injection guard and abuses an arbitrary-callable primitive to reset an administrator's password, after which an attacker can upload a malicious plugin and take complete control of the site," Wordfence said.

    Reported SupportedView cited source
  24. [24]

    The WooCommerce Wholesale Lead Capture vulnerability is tracked as CVE-2026-27540 and carries a CVSS score of 9.8.

    Reported ContestedView cited source

Sources

3 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · September 15, 2026

    Hackers target WordPress sites via third-party WooCommerce plugin
  2. infosecurity-magazine.com

    1 article · September 16, 2026

    PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug
  3. thehackernews.com

    2 articles · September 16, 2026

    Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Topics and entities

Topics

Entities