WooCommerce Wholesale Lead Capture Plugin Exploited for Unauthenticated PHP Backdoors

En bref

• Wordfence reports active exploitation of a critical flaw in WooCommerce Wholesale Lead Capture.
• The plugin has more than 6,000 active installs, according to the source excerpt.
• Unauthenticated attackers can upload arbitrary files, including PHP backdoors, leading to remote code execution.
• No CVE was listed in the source item; confirm advisory and patch details with the vendor or Wordfence.
• K-12 WordPress sites using this plugin should treat it as urgent.

Security researchers at Wordfence say attackers are actively exploiting a critical vulnerability in WooCommerce Wholesale Lead Capture, a premium WordPress plugin. The flaw allows unauthenticated users to upload arbitrary files, including PHP backdoors, which can lead to remote code execution on the affected server. The source item does not list a CVE, so defenders should verify the latest advisory and patch information directly with the vendor and Wordfence.

Any WordPress site running a vulnerable version of this plugin is potentially exposed. The plugin is reported to have more than 6,000 active installs. In a K-12 environment, WordPress may power district websites, school pages, staff portals, or public communications tools. If the plugin is present, an attacker would not need valid credentials to attempt exploitation, making automated scanning and mass exploitation more likely.

A successful web shell upload gives an attacker persistent access to the web server. From there, they could modify site content, steal data, install additional malware, use the server for further attacks, or move laterally depending on hosting configuration. Remote code execution on a public-facing web server is a serious risk because it can bypass many perimeter controls and blend into normal web traffic.

WordPress plugins remain a frequent target because they are widely deployed and sometimes overlooked in asset inventories. Premium or niche plugins can be especially easy to miss during patching. The fact that Wordfence says it has blocked attacks suggests this is not only a theoretical vulnerability but an active campaign. Even sites that do not appear to be targeted should assume scanning is ongoing.

Administrators should first determine whether WooCommerce Wholesale Lead Capture is installed and what version is running. If a patch is available, apply it immediately. If no patch exists, deactivate or remove the plugin, or apply virtual patching through a web application firewall if removal is not possible. Review logs for suspicious file uploads, unexpected PHP files in upload directories, new administrator accounts, and modified core or plugin files. Treat any signs of compromise as an incident and preserve evidence before cleanup.

À faire maintenant

1. Inventory all WordPress sites for WooCommerce Wholesale Lead Capture and record the installed version.
2. If the plugin is vulnerable and no patch is available, deactivate or remove it immediately; use a WAF for temporary virtual patching only if removal is not feasible.
3. Apply the vendor or Wordfence recommended update as soon as it is released, and verify the update actually installed.
4. Scan for web shells and unauthorized changes, especially unexpected PHP files in wp-content/uploads, recently modified files, and unknown admin users.
5. Review web server and WAF logs for POST requests to plugin endpoints and file upload attempts, then block known malicious indicators.
6. If compromise is suspected, rotate WordPress salts, administrator passwords, API keys, and database credentials, and rebuild affected systems from a known-good state.
7. Enforce MFA for WordPress administrators, apply least privilege, enable file integrity monitoring, and turn on automatic security updates where operationally safe.

Source originale

The Hacker News