WooCommerce Lead Capture Plugin Exposes 6,000+ Sites to Unauthenticated File Upload Flaw

Key points

• Wholesale Lead Capture, a WooCommerce-related WordPress plugin, is affected by a file-upload flaw.
• No authentication is needed to exploit it, and no CVE has been assigned.
• Attackers can drop PHP web shells and backdoors, leading to remote code execution.
• More than 6,000 installations are potentially exposed.
• Wordfence is involved in detection or mitigation, and admins should act quickly.

A security weakness in Wholesale Lead Capture, a WordPress extension used with WooCommerce, lets unauthenticated threat actors push files onto vulnerable sites. Wordfence has flagged the issue, but no CVE identifier has been assigned, which may slow formal tracking and patching coordination. The plugin is present on more than six thousand installations.

The flaw enables an unrestricted upload path. That means an intruder does not need valid credentials to place malicious content on a server. Once uploaded, PHP web shells can provide remote code execution, and attackers can plant backdoors for persistent access. A compromised site may be fully controlled by the adversary.

Site owners running this plugin, especially WooCommerce stores, are directly in scope. Because exploitation requires no login, automated scanners can attempt it broadly. The large install base increases the chance of opportunistic attacks against unpatched or forgotten deployments.

WordPress plugins remain a frequent entry point for mass exploitation. Wordfence can help block attacks, but defenders should not rely on a single control. With no CVE assigned, teams need to monitor vendor and security-vendor advisories closely and verify whether their version is affected.

What to watch: a vendor fix, removal guidance, or updated firewall rules. Until then, treat any site with this plugin as at risk. Review logs for suspicious uploads, scan for unexpected PHP files, and prepare to remove the plugin if no patch is available.

What to do now

1. Check the plugin vendor for an update and apply it immediately; if no fix exists, deactivate and delete Wholesale Lead Capture.
2. Use Wordfence or a web application firewall to block exploit attempts and restrict file uploads to plugin directories.
3. Scan wp-content/uploads and plugin folders for unexpected PHP files, web shells, and recently modified scripts.
4. Review web server logs for POST requests to plugin endpoints, unusual file names, and suspicious outbound connections.
5. Harden file permissions and disable PHP execution in upload directories where possible.
6. If compromise is suspected, rotate WordPress salts, administrator passwords, API keys, and other secrets.
7. Monitor Wordfence and vendor advisories for updates because no CVE has been assigned yet.

Original source

The Hacker News