Overview
- Security researcher Teemu Saarentaus disclosed an unauthenticated arbitrary file-upload flaw in the Wholesale Lead Capture plugin that affects versions 2.0.3.1 and earlier.
- The vendor issued a patch in February 2026, but many installations have not been updated and remain vulnerable to remote code execution.
- Defiant’s Wordfence has blocked more than 100,000 exploit attempts and observed attack spikes in June, July, and late August as attackers uploaded reconnaissance webshells.
- The exploit abuses the plugin’s wwlc_file_upload_handler AJAX action by submitting a forged file_settings parameter that adds 'php' to the allowed extensions so the site accepts executable files.
- Administrators are urged to update to the fixed plugin, scan upload folders and logs for unexpected .php files and admin-ajax requests, block known offending IPs, remove unknown admin accounts, and restore from clean backups if compromise is found.