BleepingComputer (15 September 2026) relays Wordfence/Defiant telemetry that attackers are actively exploiting CVE-2026-27540 in the premium WooCommerce Wholesale Lead Capture WordPress plugin. Unauthenticated AJAX action wwlc_file_upload_handler accepts a user-controlled file_settings allowlist, letting attackers permit .php uploads and drop webshells (researcher: Teemu Saarentaus). Affected: versions 2.0.3.1 and older; fixed in 2.0.3.2 (released 20 February).

Wordfence reports 100,000+ blocked attacks with spikes around 4–17 June, 1 July, and 30 August 2026; Wordfence also published a list of high-offender attacker IP addresses. Hunt admin-ajax.php calls to wwlc_file_upload_handler, unexpected PHP under uploads (e.g. shell.php), and unknown admin accounts; upgrade to 2.0.3.2+. (source: BleepingComputer)

Correction (26 Oct 2026): the CVE record for CVE-2026-27540, published by Patchstack as the assigning authority, scores it 9.0 under CVSS 3.1 (attack complexity high); an earlier version showed 9.8, which no linked source gives. (source: CVE record CVE-2026-27540)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: BleepingComputer; CVE record CVE-2026-27540)