security_identifier

CVE-2026-27540

Identifier for an unauthenticated arbitrary file upload flaw in the WooCommerce Wholesale Lead Capture WordPress plugin, rated CVSS 9.8.

Known aliases

CVE-2026-27540

Relationships

No evidence-backed relationships are recorded.

Current clusters

build1 publisher

Attackers are telling a WooCommerce plugin that PHP is an allowed upload extension

CVE-2026-27540 lets an unauthenticated POST save a PHP file, and 2.0.3.2 closes that write. Whether a file that already landed can run is a separate question, decided by how the server treats the upload directory.

Publishers:dev.to

Reality

Evidence60
Adoption38
Hype gap+10
Incentives45
Confidence55

security3 publishers

Wordfence blocked 100,000 exploit attempts against a WooCommerce plugin with 6,000 installs

CVE-2026-27540 lets an unauthenticated request add php to the plugin's own upload allowlist and drop a webshell. The fix shipped on February 20, and the first exploitation spike came 104 days later, on June 4.

Publishers:bleepingcomputer.cominfosecurity-magazine.comthehackernews.com

Reality

Evidence68
Adoption55
Hype gap+15
Incentives74
Confidence62