Particle.news

Critical WooCommerce Plugin Flaw Lets Hackers Upload PHP Webshells

An exposed admin-ajax upload action allows unauthenticated attackers to install PHP backdoors on many unpatched sites.

Overview

  • Security researcher Teemu Saarentaus disclosed an unauthenticated arbitrary file-upload flaw in the Wholesale Lead Capture plugin that affects versions 2.0.3.1 and earlier.
  • The vendor issued a patch in February 2026, but many installations have not been updated and remain vulnerable to remote code execution.
  • Defiant’s Wordfence has blocked more than 100,000 exploit attempts and observed attack spikes in June, July, and late August as attackers uploaded reconnaissance webshells.
  • The exploit abuses the plugin’s wwlc_file_upload_handler AJAX action by submitting a forged file_settings parameter that adds 'php' to the allowed extensions so the site accepts executable files.
  • Administrators are urged to update to the fixed plugin, scan upload folders and logs for unexpected .php files and admin-ajax requests, block known offending IPs, remove unknown admin accounts, and restore from clean backups if compromise is found.