Hackers target WordPress sites via third-party WooCommerce plugin

A critical unauthenticated arbitrary file-upload vulnerability (CVE-2026-27540) in the WooCommerce Wholesale Lead Capture plugin (<= 2.0.3.1) lets attackers add 'php' to an allowlist via a user-controlled parameter and upload webshells; exploitation was observed in the wild with Wordfence blocking over 100,000 attacks and advised remediation is to update to 2.0.3.2, scan for unexpected PHP files, review logs for calls to wwlc_file_upload_handler, remove unauthorized accounts, and restore from clean backups if compromise is confirmed.