Security researchers are warning that a critical flaw in a popular WooCommerce add-on is still being actively exploited — months after a fix was already available. The plugin, WooCommerce Wholesale Lead Capture, is used on more than 6,000 online stores to collect wholesale-customer enquiries, and the bug, tracked as CVE-2026-27540 with a maximum-severity 9.8 out of 10 score, lets an attacker plant a backdoor without needing any login at all.
The flaw sits in the plugin's file-upload handler, which was supposed to only accept the file types a legitimate lead form needs. Wordfence, the WordPress security firm that found and reported it, says an attacker can manipulate a hidden setting in the upload request to add "php" to the list of allowed file types, then upload a working PHP web shell straight onto the server. From there they get a browser-based control panel for the compromised site, letting them explore it, drop further malicious files, or use it as a foothold into the wider host. A fix landed in version 2.0.3.2 back in February, but Wordfence has logged more than 100,000 blocked exploitation attempts since June, with fresh attack traffic still hitting sites in the past 24 hours — a strong sign that a large share of the plugin's install base never updated.
What this means for your business
If your online store runs on WooCommerce, ask whoever manages your site whether the Wholesale Lead Capture plugin is installed — it doesn't have to be your main storefront tool to be a risk, since many stores pick it up for a specific wholesale or B2B enquiry form and then forget about it. Confirm it's on version 2.0.3.2 or later, or remove it entirely if you're not actively using it; an unused plugin sitting on an old version is exactly what this kind of automated attack scans the internet for. If you're unsure how long it's been out of date, it's worth having someone check the site's files for anything unfamiliar in the uploads folder, since attackers who got in early may have left a backdoor behind even after you patch the original hole. More generally, this is a good prompt to review every third-party plugin on your store rather than just your theme and core WooCommerce install — add-ons like this one are a common blind spot precisely because they're installed once and rarely revisited.