Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin

Élevé · Wordfence · 14 septembre 2026

WordPress

Ce qui s'est passé

Critical unauthenticated arbitrary file upload in WooCommerce Wholesale Lead Capture plugin (about 6,000 sites) is being actively exploited, allowing PHP backdoor upload and remote code execution.

À faire maintenant

Update to vendor-patched version immediately; if none, disable/remove plugin. Block PHP uploads, scan wp-content/uploads for webshells, remove malicious files, rotate admin/DB credentials, and review logs. Verify with vendor advisory.

Source originale

Wordfence

Analyse assistée par IA, sources citées. Vérifiez auprès de l'avis du fournisseur avant d'agir.