Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

A critical vulnerability (CVE-2026-27540, CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin (<=2.0.3.1) allows unauthenticated attackers to bypass server-side upload restrictions via a manipulated file_settings parameter in the wwlc_file_upload_handler, enabling PHP webshell uploads and full remote code execution; active exploitation has been observed (Wordfence blocked >100,000 attempts) and administrators are urged to update to version 2.0.3.2, inspect uploads and logs, and rotate credentials if compromise is suspected.