hacker-news · Crawled Sep 16, 2026
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
11 IoCs
Read original article ↗
AI Summary
Threat actors are actively exploiting a critical vulnerability, CVE-2026-27540, in the WooCommerce Wholesale Lead Capture WordPress plugin to upload arbitrary PHP files, including web shells such as 'shell.php', enabling remote code execution. The flaw stems from missing file type validation in the 'wwlc_file_upload_handler' AJAX action, affecting all versions up to and including 2.0.3.1. Attack attempts have been observed from multiple IP addresses, with over 100,000 exploit attempts blocked by Wordfence since June 2026.
AI-extracted · verify before operational use
Indicators of Compromise 11 extracted
| Type | Value | Detail |
|---|---|---|
| IP | 92[.]241[.]13[.]213 | Details → |
| IP | 31[.]59[.]129[.]150 | Details → |
| IP | 2a0f:85c1:840:5389::1 | Details → |
| IP | 92[.]241[.]13[.]140 | Details → |
| IP | 23[.]137[.]105[.]214 | Details → |
| IP | 23[.]180[.]120[.]140 | Details → |
| IP | 104[.]194[.]9[.]138 | Details → |
| IP | 187[.]75[.]114[.]36 | Details → |
| IP | 114[.]10[.]43[.]203 | Details → |
| IP | 37[.]114[.]144[.]209 | Details → |
| Filename | shell.php | Details → |