Wordfence blocked 100,000 exploit attempts against a WooCommerce plugin with 6,000 installs

The plugin asks the client which file extensions to trust. According to Wordfence, the AJAX action wwlc_file_upload_handler checks an uploaded file's extension against an allowlist carried in the file_settings request parameter, and the requester supplies that parameter ^[4]. Add php to the list and the plugin accepts a PHP file. "The attacker submits a request to the wwlc_file_upload_handler AJAX action containing a forged file_settings parameter and a malicious file with a .php extension," Wordfence said ^[6]. Security researcher Teemu Saarentaus found the flaw ^[8].

The gap between the fix and the first recorded spike is 104 days ^[13]. So the population at risk is narrow and identifiable: sites still running 2.0.3.1 or older between June 4 and August 30 ^[12].

More than 100,000 blocked attempts against a plugin with more than 6,000 active installs works out at roughly 17 blocked requests per install ^[14]. Wordfence's figure counts requests its firewall blocked across the sites it protects, and neither writeup says how many of those sites had the plugin installed. A ratio like that comes from scanners that fire the request at every host and read the response to learn which ones run the plugin.

Wordfence recorded 99 attempts in the 24 hours before publication ^[11]. Across the 87 days from June 4 to August 30, 100,000 blocked requests average about 1,150 a day ^[15].

For a site that was exposed in that window, the check is on disk and in logs: unexpected or recently created .php files in the uploads directory, and requests to /wp-admin/admin-ajax.php with the action parameter set to wwlc_file_upload_handler ^[17]. Wordfence also says to remove administrator accounts you do not recognise ^[17]. It published ten high-offender addresses, among them 92.241.13.213 and the IPv6 host 2a0f:85c1:840:5389::1 ^[16]. Where compromise is confirmed, Defiant's advice is to restore from a safe backup, because removing every persistence mechanism, user and backdoor may be complicated ^[18].

The same writeup covers The Events Calendar, on more than 600,000 sites ^[19]. CVE-2026-78159 sits in the parse_array validation of a widget classes map and affects versions up to 6.17.3; CVE-2026-78006 sits in is_safe_widget_instance and affects versions up to 6.17.4 ^[20][21]. Exploitation needs comments enabled on the target event page and the plugin's "Show comments on event pages" option active ^[23], and Wordfence says both chains can be triggered through WordPress's pending-comment preview without moderator approval ^[24]. The 100,000 blocked requests belong to the lead capture flaw.

"The first chain uses PHP Object Injection to execute arbitrary operating system commands on the underlying server. The second chain bypasses the object-injection guard and abuses an arbitrary-callable primitive to reset an administrator's password, after which an attacker can upload a malicious plugin and take complete control of the site," Wordfence said ^[25].