Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Cybersecurity researchers at Wordfence have disclosed that threat actors are actively exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin used for capturing wholesale leads. The vulnerability, which can be leveraged by unauthenticated attackers, allows the upload of arbitrary files, including PHP backdoors, resulting in remote code execution on affected websites.

According to Wordfence, the company has blocked multiple exploitation attempts, indicating that the flaw is being actively targeted in the wild. The plugin has more than 6,000 active installs, putting a significant number of WordPress sites at risk.

The exact technical details of the vulnerability have not been fully disclosed, but the impact is severe: an attacker could gain complete control of the affected website, potentially leading to data theft, site defacement, or further compromise of the server.

At the time of writing, no CVE identifier has been assigned, and the availability of a patch is unclear. Users are strongly advised to check for updates from the plugin developer and apply any available fixes immediately. In the absence of a patch, site administrators should consider disabling the plugin until a secure version is released.

Wordfence has not yet published a detailed advisory, but their detection rules are likely in place to block exploit attempts. Organizations using this plugin should monitor Wordfence's official channels for updates and take proactive measures to secure their WordPress installations.