WooCommerce Wholesale Lead Capture: Unauthenticated Webshell Upload Campaign

Threat Overview

A critical arbitrary file upload vulnerability in the WooCommerce Wholesale Lead Capture plugin is actively being exploited in the wild to drop persistent webshells and compromise B2B e-commerce stores. Tracked as CVE-2026-27540, the vulnerability allows unauthenticated remote visitors submitting wholesale application forms to upload arbitrary executable files—including PHP backdoors—directly to the hosting server’s public file tree.

Because this plugin is designed to allow prospective wholesale buyers to register and attach business licenses or tax exemption certificates, the vulnerable upload handler is publicly accessible by default on thousands of commercial merchant sites.

The Breakdown: How the Exploit Works

The Wholesale Lead Capture plugin provides prospective B2B clients with a registration form that accepts verification documents (such as PDF tax forms or JPEG business licenses).

In versions up to 2.1.4, the AJAX file processing routine failed to perform server-side file extension validation and lacked cryptographic verification of uploaded file contents. Instead, the plugin relied entirely on client-side JavaScript checks and easily spoofed Content-Type headers passed in the HTTP request.

An attacker sends a raw multipart HTTP POST request to the upload endpoint containing a malicious PHP script with a double extension (such as license.php.png or tax-cert.phtml). The server saves the file directly into wp-content/uploads/wholesale-leads/ with execute permissions intact. The attacker then makes a single GET request to the uploaded file to gain full interactive terminal control over the server.

The Operational Risk: What an Attacker Gains

• Immediate Web Server Compromise: Attackers achieve unauthenticated remote command execution under the web server user identity (www-data or nginx).
• Payment & Customer Data Theft: Intruders inject credit card skimmers (Magecart-style payloads) into WooCommerce checkout templates, harvesting customer billing details in real time.
• Database Exfiltration: Attackers read wp-config.php, dumping database credentials and harvesting all customer purchase histories, wholesale pricing structures, and password hashes.
• Botnet & Phishing Distribution: Compromised commercial stores are weaponized to host SEO spam farms, malicious malware droppers, and outbound phishing landing pages.

Our Take in Plain English

“When you operate a B2B or wholesale commerce business, making onboarding seamless for new accounts is critical. But on traditional WordPress setups, allowing the public to upload files is like handing strangers an unlocked thumb drive and letting them plug it straight into your main server. A simple file-check oversight turns a wholesale registration form into an open door for server takeovers and payment skimming. Modern commerce architecture decouples lead collection from your hosting filesystem entirely.”

The Modern Architectural Remedy

• Legacy Dynamic WooCommerce: Public lead forms write directly to the web server’s local storage where executable code can be invoked immediately via public URLs.
• Modern Pre-Rendered Edge Architecture: Front-facing catalogs and B2B intake forms run on immutable edge networks. Document uploads are routed directly to isolated, quarantined cloud object storage (such as Cloudflare R2 or Amazon S3) with zero local PHP execution capability.

Immediate Action Items for WordPress Operators

1. Apply the 2.1.5 Patch Immediately: Update the WooCommerce Wholesale Lead Capture plugin to version 2.1.5 or higher right away.
2. Inspect the Uploads Directory: Check wp-content/uploads/wholesale-leads/ and general upload folders for executable scripts (.php, .phtml, .php5, .suspected).
3. Block Execution via Web Server Rules: Ensure Nginx or Apache .htaccess rules explicitly forbid script execution in all subdirectories of wp-content/uploads/.
4. Audit WooCommerce Orders & Gateways: Verify payment gateway configurations to ensure merchant payout accounts and webhook listeners have not been altered.