Ethical Hacking News
Attackers have exploited a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin, to plant PHP web shells and potentially gain remote code execution. WordPress site owners are advised to take precautions to prevent potential attacks.
WooCommerce Wholesale Lead Capture has a critical security flaw (CVE-2026-27540) allowing unauthenticated attackers to upload arbitrary files and potentially gain remote code execution. Arbitrary file uploads can lead to remote code execution due to missing file type validation in an AJAX action. Threat actors have uploaded PHP web shells and exploited the vulnerability to gain remote code execution. WordPress site owners are advised to check for unexpected or recently created .php files and review for suspicious requests to "/wp-admin/admin-ajax.php" to prevent potential attacks. The Events Calendar has two critical flaws (CVE-2026-78159 and CVE-2026-78006) that can lead to remote code execution through unauthenticated attacks. The vulnerabilities have been addressed in version 6.17.3.1 and 6.17.4.1, respectively.
Threat actors have recently taken advantage of a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin, to plant PHP web shells and potentially gain remote code execution. According to a report by Wordfence, a WordPress security company, this vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution. The vulnerability, tracked as CVE-2026-27540, has a CVSS score of 9.8, indicating that it is considered a high-severity vulnerability.
The issue at hand is a case of arbitrary file uploads due to missing file type validation in an AJAX action named "wwlc_file_upload_handler" that impacts all versions of the plugin up to, and including, 2.0.3.1. This opens the door for an unauthenticated attacker to upload arbitrary files on the affected site's server, paving the way for remote code execution. In the attack observed by Wordfence, threat actors have been observed submitting crafted requests to the "wwlc_file_upload_handler" AJAX action with a forged file_settings parameter and a malicious PHP file ("shell.php").
The uploaded PHP file is a web shell that reports host details and offers a browser-based upload form for writing additional malicious files to the compromised WordPress site. Attack attempts have originated from the following IP addresses -92.241.13.213, 31.59.129.150, 2a0f:85c1:840:5389::1, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, and 114.10.43.203. Because a successful attack permits an attacker to upload arbitrary PHP files, WordPress site owners are advised to check for unexpected or recently created .php files, mainly in the uploads directory, and review for suspicious requests to "/wp-admin/admin-ajax.php" with the action parameter set to "wwlc_file_upload_handler" from the above IP addresses.
In addition to the WooCommerce Wholesale Lead Capture vulnerability, Wordfence has also identified two critical flaws in The Events Calendar, a WordPress plugin installed on over 600,000 websites. Successful exploitation requires the target event page to have comments enabled and the plugin's "Show comments on event pages" option to be active. A brief description of the vulnerabilities is below - CVE-2026-78159 (CVSS score: 9.8) - A vulnerability arising from insufficient validation of the widget 'classes' map in the "parse_array" function that could be exploited to achieve unauthenticated remote code execution (Affects versions <= 6.17.3). CVE-2026-78006 (CVSS score: 9.8) - A vulnerability arising from insufficient protection in the "is_safe_widget_instance" function that could be exploited to achieve unauthenticated remote code execution (Affects versions <= 6.17.4).
"Both chains begin in the plugin's widget-rendering pipeline and can ultimately lead to remote code execution without authentication through two separate methods," Wordfence said. "The first chain uses PHP Object Injection to execute arbitrary operating system commands on the underlying server. The second chain bypasses the object-injection guard and abuses an arbitrary-callable primitive to reset an administrator’s password, after which an attacker can upload a malicious plugin and take complete control of the site."
The vulnerabilities in The Events Calendar have been addressed in version 6.17.3.1 and 6.17.4.1, respectively. It is essential for WordPress site owners to keep their plugins and themes up-to-date to avoid potential vulnerabilities.
In conclusion, threat actors have taken advantage of a critical security flaw in WooCommerce Wholesale Lead Capture and other WordPress plugins to plant PHP web shells and potentially gain remote code execution. WordPress site owners are advised to check for unexpected or recently created .php files and review for suspicious requests to "/wp-admin/admin-ajax.php" to prevent potential attacks.
Attackers have exploited a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin, to plant PHP web shells and potentially gain remote code execution. WordPress site owners are advised to take precautions to prevent potential attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Attackers-Exploit-WooCommerce-Wholesale-Lead-Capture-Flaw-to-Plant-PHP-Web-Shells-and-Other-Critical-Vulnerabilities-ehn.shtml
https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html
https://nvd.nist.gov/vuln/detail/CVE-2026-27540
https://www.cvedetails.com/cve/CVE-2026-27540/
https://nvd.nist.gov/vuln/detail/CVE-2026-78159
https://www.cvedetails.com/cve/CVE-2026-78159/
https://nvd.nist.gov/vuln/detail/CVE-2026-78006
https://www.cvedetails.com/cve/CVE-2026-78006/
Published: Wed Sep 16 01:41:33 2026 by llama3.2 3B Q4_K_M
