WooCommerce Plugin Flaw Fuels Web Shell Attacks

A premium WordPress plugin with more than 6,000 active installations has become the entry point for a wave of attacks that let unauthenticated intruders plant persistent backdoors on vulnerable sites. According to WordPress security firm Wordfence, threat actors are actively exploiting a critical flaw in WooCommerce Wholesale Lead Capture to upload arbitrary files, including PHP web shells, and take control of affected servers.

The vulnerability, tracked as CVE-2026-27540, carries a CVSS score of 9.8 and affects all versions of the plugin up to and including 2.0.3.1. Wordfence said it has blocked more than 100,000 exploit attempts since June 2026, with 99 of those attacks recorded in the past 24 hours.

How the file upload flaw works

The issue stems from missing file type validation in an AJAX action called wwlc_file_upload_handler. Because the handler does not properly check the type of files being submitted, an unauthenticated attacker can upload arbitrary files to a site's server. That capability paves the way for remote code execution, the most severe class of web vulnerability.

In the attacks observed by Wordfence, intruders submitted crafted requests to the AJAX action with a forged file_settings parameter and a malicious PHP file named shell.php. Once executed, the uploaded file acts as a web shell that reports host details and provides a browser-based upload form for writing additional malicious files to the compromised WordPress installation.

Attack traffic and indicators

Wordfence listed the IP addresses from which the exploit attempts originated:

• 92.241.13.213
• 31.59.129.150
• 2a0f:85c1:840:5389::1
• 92.241.13.140
• 23.137.105.214
• 23.180.120.140
• 104.194.9.138
• 187.75.114.36
• 114.10.43.203
• 37.114.144.209

Because a successful attack allows arbitrary PHP files to be written to the server, site owners are advised to check for unexpected or recently created .php files, particularly in the uploads directory. They should also review logs for suspicious requests to /wp-admin/admin-ajax.php with the action parameter set to wwlc_file_upload_handler coming from the addresses above.

Second critical chain in The Events Calendar

The WooCommerce exploitation wave was disclosed alongside two critical vulnerabilities in The Events Calendar, a WordPress plugin installed on over 600,000 websites. Wordfence detailed the flaws, which require the target event page to have comments enabled and the plugin's "Show comments on event pages" option to be active.

The first, CVE-2026-78159 (CVSS score: 9.8), arises from insufficient validation of the widget 'classes' map in the parse_array function and affects versions through 6.17.3. The second, CVE-2026-78006 (CVSS score: 9.8), stems from insufficient protection in the is_safe_widget_instance function and affects versions through 6.17.4.

"Both chains begin in the plugin's widget-rendering pipeline and can ultimately lead to remote code execution without authentication through two separate methods," Wordfence said.

— Wordfence

The company explained how each chain operates. "The first chain uses PHP Object Injection to execute arbitrary operating system commands on the underlying server. The second chain bypasses the object-injection guard and abuses an arbitrary-callable primitive to reset an administrator’s password, after which an attacker can upload a malicious plugin and take complete control of the site."

Both chains can be triggered through WordPress's pending-comment preview without moderator approval, according to the advisory. The consequences include complete site takeover, sensitive data theft, and malware deployment. StellarWP, which develops the plugin, has addressed the flaws in versions 6.17.3.1 and 6.17.4.1, respectively.

Why the WooCommerce flaw is so dangerous

Unlike many WordPress vulnerabilities that require authentication or a specific user role, the WooCommerce Wholesale Lead Capture flaw can be exploited by anyone who can reach the affected AJAX endpoint. The missing file type validation means there is no gatekeeping on what gets written to disk, making it trivial for an attacker to drop a PHP backdoor and then use it to stage further payloads.

Wordfence's decision to block over 100,000 exploit attempts since June 2026 underscores how quickly automated tooling has latched onto the bug. The 99 attempts in the last 24 hours, as reported by the firm, show that scanning and exploitation are ongoing rather than a one-time burst.

Mitigation steps for site owners

The most direct fix is to update WooCommerce Wholesale Lead Capture to a version beyond 2.0.3.1. Because the vulnerability affects all versions up to and including that release, any site still running an older copy remains exposed. Site owners who cannot immediately patch should consider disabling the plugin until an update is applied.

Beyond patching, administrators should hunt for signs of compromise. A web shell like shell.php often leaves telltale artifacts: new files in the uploads directory, unexpected PHP files in writable locations, and outbound connections to unfamiliar hosts. Reviewing web server logs for requests to /wp-admin/admin-ajax.php with the wwlc_file_upload_handler action can reveal prior exploitation attempts, especially if the source IP matches the list published by Wordfence.

For The Events Calendar, the advice is similar: update to version 6.17.3.1 or 6.17.4.1. Because exploitation requires comments to be enabled on event pages and the plugin's comment display option to be active, site owners who do not need that functionality might consider disabling it as a temporary measure, though patching remains the definitive remediation.

What the numbers say

The scale of the activity is significant. Wordfence reports more than 6,000 active installs for WooCommerce Wholesale Lead Capture and over 600,000 for The Events Calendar. The WooCommerce flaw has a CVSS score of 9.8, and both Events Calendar flaws share that same critical rating. Wordfence has blocked over 100,000 exploit attempts since June 2026, including 99 in the past 24 hours. At least 10 distinct IP addresses have been linked to the WooCommerce attacks.

What this means for WordPress site operators

The dual disclosure highlights a persistent problem for WordPress users: plugins add functionality but also expand the attack surface, often in ways that are invisible until an exploit lands. A vulnerability in a lead-capture add-on may seem niche, but automated scanners do not care about popularity — they test every endpoint they can find. The fact that unauthenticated attackers can chain the WooCommerce flaw to full remote code execution means that a single outdated plugin can compromise an entire site, its data, and any services hosted on the same server.

For businesses running WooCommerce or The Events Calendar, the immediate priority is to verify plugin versions and apply the available updates. After that, a thorough compromise assessment is warranted, because a web shell can remain dormant and allow re-entry even after the vulnerable plugin is patched. The combination of high CVSS scores, active exploitation, and widespread installation numbers suggests that attacks will continue as long as unpatched sites remain reachable. Site owners who treat plugin updates as routine maintenance may need to treat them instead as emergency security work when flaws of this severity are being actively exploited.