Threat actors are actively exploiting a critical security flaw in **WooCommerce Wholesale Lead Capture**, a premium **WordPress** plugin with over 6,000 active installations. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution," reported **Wordfence**, a leading **WordPress** security company.  **Wordfence** has blocked over 100,000 exploit attempts targeting this vulnerability since June 2026, with 99 attacks recorded in a recent 24-hour period. The flaw is tracked as **CVE-2026-27540** with a CVSS score of 9.8, indicating its critical severity. ### Arbitrary File Upload in WooCommerce Plugin The vulnerability stems from missing file type validation in an AJAX action named "wwlc_file_upload_handler," affecting all versions of the plugin up to and including 2.0.3.1. This oversight allows an unauthenticated attacker to upload arbitrary files, including malicious PHP web shells, to the server, enabling remote code execution. **Wordfence** observed attackers submitting crafted requests to the "wwlc_file_upload_handler" AJAX action, using a forged `file_settings` parameter and a malicious PHP file, typically named "shell.php." This web shell provides host details and a browser-based upload form for further malicious file deployment. Observed attack attempts have originated from the following IP addresses: * 92.241.13.213 * 31.59.129.150 * 2a0f:85c1:840:5389::1 * 92.241.13.140 * 23.137.105.214 * 23.180.120.140 * 104.194.9.138 * 187.75.114.36 * 114.10.43.203 * 37.114.144.209 **WordPress** site owners using **WooCommerce Wholesale Lead Capture** are advised to check for unexpected or recently created `.php` files, especially in the `uploads` directory. They should also review server logs for suspicious requests to `/wp-admin/admin-ajax.php` with the action parameter set to `wwlc_file_upload_handler` originating from the aforementioned IP addresses. ### Critical Flaws in The Events Calendar Plugin Concurrently, **Wordfence** has detailed two other critical vulnerabilities impacting **The Events Calendar**, another widely used **WordPress** plugin installed on over 600,000 websites. Successful exploitation of these flaws requires comments to be enabled on the target event page and the plugin's "Show comments on event pages" option to be active. These vulnerabilities include: * **CVE-2026-78159** (CVSS score: 9.8): An issue in the "parse_array" function due to insufficient validation of the widget 'classes' map, leading to unauthenticated remote code execution. (Affects versions <= 6.17.3) * **CVE-2026-78006** (CVSS score: 9.8): A vulnerability in the "is_safe_widget_instance" function due to insufficient protection, allowing unauthenticated remote code execution. (Affects versions <= 6.17.4) "Both chains begin in the plugin's widget-rendering pipeline and can ultimately lead to remote code execution without authentication through two separate methods," **Wordfence** explained. "The first chain uses PHP Object Injection to execute arbitrary operating system commands on the underlying server. The second chain bypasses the object-injection guard and abuses an arbitrary-callable primitive to reset an administrator’s password, after which an attacker can upload a malicious plugin and take complete control of the site." **Wordfence** warns that both attack chains can be triggered via **WordPress**'s pending-comment preview without moderator approval. Exploitation could lead to complete site takeover, sensitive data theft, and malware deployment. **StellarWP**, the developer of **The Events Calendar**, has addressed these flaws in versions 6.17.3.1 and 6.17.4.1, respectively. Users are strongly advised to update their plugins immediately.