Actively Exploited File Upload Flaw Hits WooCommerce Wholesale Plugin

En bref

• Critical unauthenticated arbitrary file upload disclosed February 20, 2026 in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with roughly 6,000 active installs.
• Attackers are actively exploiting it now; no credentials are needed, and successful exploitation can result in remote code execution.
• Typical impact is a PHP backdoor or web shell, giving full control of the site and its hosting account.
• No CVE identifier was included in the source material, so administrators should confirm the vendor's patched release before assuming an update resolves the issue.

Wordfence reported on February 20, 2026 that a critical arbitrary file upload vulnerability in the premium WordPress plugin WooCommerce Wholesale Lead Capture is being exploited in the wild. The flaw is unauthenticated, meaning an attacker does not need an account, a password, or any prior access to the site. Approximately 6,000 active installations are estimated, and the plugin is used mainly by businesses and organizations that run wholesale or B2B lead-capture workflows on top of WooCommerce.

The practical consequence is severe. Because arbitrary files can be uploaded, an attacker can place a PHP backdoor in a web-accessible location and then execute it, achieving remote code execution. From there, a site can be fully controlled: content altered, customer and lead data exfiltrated, administrative accounts created, and the server used as a staging point for further attacks. Exploitation is reported to be underway, not merely theoretical, which raises the urgency of patching or removing the plugin.

For K-12 and government web properties, the immediate exposure depends on whether the plugin is present on any externally facing WordPress instance. Even where schools do not sell wholesale products, districts sometimes run WooCommerce for fee collection, fundraising, or community programs, and third-party vendors may host sites on their behalf. Any site running this plugin should be treated as potentially compromised until proven otherwise. The absence of a CVE identifier in the source material means tracking coverage may lag; administrators should rely on the vendor's advisory and Wordfence's vulnerability database rather than waiting for a CVE to appear.

What to watch: confirmation of a patched plugin version, indicators of compromise such as unexpected PHP files in upload or cache directories, and outbound connections from the web server. Because file upload flaws are commonly chained with persistence mechanisms, a clean-up that only deletes a visible shell may leave the attacker with continued access. Verify plugin inventory, patch or remove the component, and audit for follow-on activity before returning a site to service.

À faire maintenant

1. Inventory every WordPress instance, including vendor-hosted sites, for WooCommerce Wholesale Lead Capture and record the installed version.
2. If the plugin is present, apply the vendor's patched release immediately or deactivate and remove it until a fix is confirmed.
3. Scan the uploads, cache, and plugin directories for unexpected .php files; preserve copies for forensics before deleting anything.
4. Rotate WordPress admin credentials, database passwords, SFTP/SSH keys, API tokens, and authentication salts if compromise is suspected.
5. Review web and application logs for POST requests to plugin endpoints and for file-write events, and check for new or modified administrator accounts.
6. Harden the web tier by blocking PHP execution in upload directories and adding WAF rules for the affected plugin paths.
7. If a backdoor is confirmed, rebuild the site from a known-good backup taken before the disclosure date and re-audit for persistence.

Source originale

Wordfence