CVE-2026-27540 WooCommerce Flaw Exploited

CVE-2026-27540 is a critical (CVSS-equivalent 9.8) unauthenticated arbitrary file-upload vulnerability in the WooCommerce Wholesale Lead Capture plugin that allows attackers to upload executable PHP files and potentially achieve remote code execution; Wordfence has reported more than 100,000 blocked exploitation attempts targeting vulnerable versions (<= 2.0.3.1), and organizations are urged to update to 2.0.3.2, hunt for signs of compromise (admin-ajax.php requests, unexpected PHP uploads, modified files, rogue accounts), and apply mitigations if immediate patching is not possible.