Unauthenticated attackers are exploiting a critical vulnerability in WooCommerce Wholesale Lead Capture to upload malicious PHP files and gain remote code execution on vulnerable WordPress sites. Wordfence reports blocking over attacks targeting the flaw in this premium WordPress plugin, which powers more than 6,000 active installations.
The vulnerability allows attackers to bypass authentication entirely and upload arbitrary files to affected servers. Threat actors weaponize this by planting PHP web shells, which grant persistent remote access and enable full system compromise. Once installed, these backdoors let attackers execute commands, steal data, modify website content, or use compromised sites as staging grounds for further attacks.
WooCommerce Wholesale Lead Capture is a premium plugin designed to help B2B merchants capture and manage wholesale customer inquiries. The plugin's broad install base across WordPress sites makes it an attractive target for mass exploitation campaigns. Wordfence's blocking data suggests active, widespread attack attempts already underway.
The attack chain is straightforward from the attacker's perspective. The vulnerability permits file uploads without requiring valid credentials or CSRF tokens. An attacker sends a crafted request to the vulnerable upload endpoint, delivers a PHP payload embedded as an image or archive file, and the server processes it without proper validation. The uploaded PHP file becomes executable within the web root, allowing immediate code execution and persistence.
Organizations running WooCommerce Wholesale Lead Capture face immediate risk. Compromised sites can suffer data theft, malware distribution to visitors, search engine delisting, or use in botnet operations. E-commerce sites storing customer payment or shipping data face heightened exposure if breached through this vector. WordPress administrators cannot assume their sites are safe based on firewall rules alone, since the flaw requires no authentication.
The plugin developer has not yet published a patched version according to available information. Site owners relying on this plugin should disable it immediately and evaluate alternative solutions. Web application firewalls may offer temporary mitigation by blocking suspicious file uploads or PHP execution in upload directories, but removing the vulnerable plugin remains the only reliable remediation.
WordPress administrators should audit their installed plugins for this flaw using security scanning tools. Wordfence offers free and premium scanning capabilities that detect vulnerable plugin versions. Site owners should also review web server logs for suspicious POST requests to upload endpoints or for newly created PHP files in media directories, which would indicate successful exploitation.
The incident underscores persistent risks in the WordPress ecosystem. Premium plugins sometimes receive less security scrutiny than popular free alternatives. Developers may patch vulnerabilities slowly, leaving users exposed for extended periods. Organizations should apply the principle of least privilege to plugin functionality, use security scanning regularly, and maintain current backups for rapid recovery after compromise.
A CVE identifier for this vulnerability has not been confirmed in available reports, but Wordfence's early warning allows proactive defense before exploit toolkits become widespread. Security teams should flag this as a priority remediation item and prioritize it above lower-risk updates in their patch schedules.