WordPress Plugin Attacks: Critical RCE Flaws Exposed

The report details active exploitation of critical WordPress plugin vulnerabilities—CVE-2026-27540 in WooCommerce Wholesale Lead Capture (unauthenticated arbitrary file upload used to deploy PHP web shells) and two CVSS 9.8 vulnerabilities in The Events Calendar enabling unauthenticated RCE—notes widespread scanning/attempts (100,000+), provides IoCs, affected versions, and remediation guidance for administrators.