CVE-2026-27540

This vulnerability is like leaving a door unlocked where anyone can drop a “malicious tool” onto your server. Attackers have been using it to upload PHP backdoors (web shells) that can let them take control of the site and potentially access sensitive data.

For a small business, that usually means your website can be turned against you quickly—so it’s not something to wait on.

This matters if you use the WordPress plugin “Woocommerce Wholesale Lead Capture” in versions up to and including 2.0.3.1. Because the upload is unauthenticated, it does not require a login, so any exposed internet-facing WordPress site with the plugin enabled is at risk.

Exposure depends on whether the plugin is installed and reachable on your website (and enabled); if the vulnerable upload handler can be reached from the internet, you should treat it as active risk given reported exploitation.

RED. Attackers are already exploiting this issue in the wild to upload PHP web shells, and exploitation activity has been reported with clear spikes since early June 2026. That means this is not theoretical—your site can be compromised if the plugin is present and reachable.