Introduction: WordPress Plugin Attacks — Why It Matters
WordPress Plugin Attacks are drawing attention after threat actors reportedly exploited a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin to upload malicious PHP files and establish web shells. Wordfence said it has blocked more than 100,000 exploit attempts targeting the flaw since June 2026.
The vulnerability, tracked as CVE-2026-27540 and rated CVSS 9.8, affects WooCommerce Wholesale Lead Capture versions up to and including 2.0.3.1. The development comes alongside disclosures of two other critical vulnerabilities in The Events Calendar, a WordPress plugin installed on more than 600,000 websites.
Together, the incidents highlight the security risks created by vulnerable WordPress plugins, particularly flaws that can be exploited without authentication.
What Caused the Incident?
The WooCommerce Wholesale Lead Capture issue is an arbitrary file-upload vulnerability caused by missing file-type validation in the wwlc_file_upload_handler AJAX action.
According to Wordfence, attackers can submit specially crafted requests containing a forged file_settings parameter and a malicious PHP file. Successful exploitation can allow arbitrary files to be written to the server, potentially leading to remote code execution.
The observed attacks reportedly involved a PHP web shell named shell.php. The web shell can provide information about the compromised host and offer functionality for uploading additional malicious files.
The second incident involves The Events Calendar, which has two critical vulnerabilities:
- CVE-2026-78159: CVSS 9.8, affecting versions up to 6.17.3.
- CVE-2026-78006: CVSS 9.8, affecting versions up to 6.17.4.
Wordfence reported that both vulnerabilities involve weaknesses in the plugin’s widget-rendering pipeline and can ultimately result in unauthenticated remote code execution.
WordPress Plugin Attacks: Technical Breakdown
Timeline of Events
Wordfence reported that exploitation attempts against CVE-2026-27540 have been occurring since June 2026. More than 100,000 attempts were reportedly blocked, including 99 attempts during the 24 hours covered by the report.
The observed activity involved requests sent to:
/wp-admin/admin-ajax.php
with the AJAX action:
wwlc_file_upload_handler
The Events Calendar vulnerabilities were separately disclosed as critical unauthenticated RCE chains.
What Systems Are Potentially Affected?
WordPress Plugin Attacks involve:
- WooCommerce Wholesale Lead Capture versions 2.0.3.1 and earlier
- The Events Calendar versions 6.17.3 and earlier for CVE-2026-78159
- The Events Calendar versions 6.17.4 and earlier for CVE-2026-78006
- WordPress installations running vulnerable plugin versions
- PHP files uploaded through vulnerable functionality
- Websites where The Events Calendar has comments enabled and its event-page comment option is active
For The Events Calendar, one reported exploitation chain can use PHP Object Injection to execute operating-system commands. Another can bypass an object-injection protection mechanism, reset an administrator password and potentially allow a malicious plugin to be uploaded.
Potential Risks & Impact
Website and Server Risk
Successful exploitation of the WooCommerce vulnerability can allow attackers to place PHP web shells on a website. This can provide a foothold for additional malicious activity and potentially enable remote code execution.
The Events Calendar vulnerabilities could similarly result in unauthorized server-level activity and complete WordPress site compromise.
Business and Reputational Risk
A compromised WordPress website can be modified to distribute malicious files, redirect visitors, host unauthorized content or serve as part of a larger attack infrastructure.
For businesses, such incidents can also affect website availability, customer trust and operational continuity.
Regulatory and Compliance Risk
If attackers gain access to sensitive information through a compromised website, organizations may also need to assess their legal and regulatory obligations. The specific requirements depend on the organization, affected data and applicable jurisdiction.
Official Response / Statement
According to Wordfence’s security research, CVE-2026-27540 has been associated with active exploitation, making prompt investigation and patching important.
The WooCommerce Wholesale Lead Capture vulnerability affects versions through 2.0.3.1. For The Events Calendar, StellarWP addressed the reported vulnerabilities in versions 6.17.3.1 and 6.17.4.1, respectively.
Website administrators should consult the relevant vendor and security advisories before determining whether an installation has been fully remediated.
Industry Context: Why WordPress Plugin Attacks Are Increasing
WordPress plugins extend website functionality, but they also introduce additional software components that require regular security maintenance. Vulnerabilities involving file uploads, authentication bypasses and unsafe processing can become particularly serious when attackers can reach them without logging in.
The scale of WordPress Plugin Attacks makes plugin monitoring an important part of website security. Organizations tracking similar incidents can also follow CyberNexora’s Cyber Incidents coverage for related security developments.
The combination of publicly disclosed vulnerabilities and automated scanning can allow attackers to identify exposed websites rapidly. This makes timely patching especially important for administrators managing multiple WordPress installations.
How to Protect Yourself / Your Organization
- Update vulnerable plugins immediately: Upgrade WooCommerce Wholesale Lead Capture and The Events Calendar to versions that address the reported vulnerabilities.
- Check for unauthorized PHP files: Search especially in WordPress upload directories for recently created or unexpected
.phpfiles. - Review AJAX activity: Investigate suspicious requests to
/wp-admin/admin-ajax.php, particularly those usingwwlc_file_upload_handler. - Inspect administrator accounts: Review WordPress users for unexpected administrator accounts or recent password changes.
- Use file-integrity monitoring: Monitor important WordPress directories for unexpected modifications and newly created executable files.
- Restrict unnecessary plugin access: Remove unused plugins and keep only software that is actively required.
- Maintain reliable backups: Keep tested, offline or otherwise protected backups so a compromised website can be restored safely.
- Monitor security advisories: Follow trusted vulnerability disclosures and apply security updates as soon as practical. Additional security guidance is available through CyberNexora’s Learn & Protect resources.
Indicators of Compromise (IoCs)
Administrators investigating possible exploitation can review the following indicators reported in connection with the WooCommerce Wholesale Lead Capture activity:
92.241.13.21331.59.129.1502a0f:85c1:840:5389::192.241.13.14023.137.105.21423.180.120.140104.194.9.138187.75.114.36114.10.43.20337.114.144.209- Suspicious
shell.phpor other unexpected PHP files - Requests containing
wwlc_file_upload_handler
IP-based indicators should be treated as investigation clues rather than permanent blocklists because infrastructure can change.
Key Takeaways
- WordPress Plugin Attacks include active exploitation of CVE-2026-27540 in WooCommerce Wholesale Lead Capture.
- The vulnerability can allow unauthenticated arbitrary file uploads and potentially remote code execution.
- The Events Calendar has two additional critical vulnerabilities rated CVSS 9.8.
- Web shells and unexpected PHP files can indicate successful exploitation.
- Administrators should patch vulnerable plugins and investigate suspicious website activity promptly.
Conclusion: WordPress Plugin Attacks and What Happens Next
The reported WordPress Plugin Attacks demonstrate how vulnerable third-party components can expose websites to serious compromise. The combination of unauthenticated access, arbitrary file uploads and remote code execution makes timely remediation particularly important.
Administrators should continue monitoring WordPress logs, plugin advisories, file changes and administrator accounts for signs of exploitation. CyberNexora’s Cyber Incidents section can also be used to follow further developments affecting WordPress and other widely deployed technologies.
Frequently Asked Questions (FAQs)
The report covers active exploitation of a critical WooCommerce Wholesale Lead Capture vulnerability and two critical vulnerabilities in The Events Calendar. The reported flaws can potentially enable unauthenticated remote code execution.
CVE-2026-27540 is a critical arbitrary file-upload vulnerability in WooCommerce Wholesale Lead Capture. It is rated CVSS 9.8 and can potentially allow attackers to upload malicious PHP files and execute code remotely.
Versions up to and including 2.0.3.1 are affected by the reported vulnerability. Administrators should update to a fixed release provided by the plugin vendor.
The reported vulnerabilities are CVE-2026-78159 and CVE-2026-78006, both rated CVSS 9.8. They can potentially lead to unauthenticated remote code execution under the reported exploitation conditions.
Administrators should search for unexpected PHP files, particularly in upload directories, and investigate suspicious requests to admin-ajax.php involving wwlc_file_upload_handler. Reviewing administrator accounts and recent file modifications can also help identify compromise.
Users should update vulnerable plugins, remove unused plugins, maintain tested backups, monitor file changes and review security logs. They should also follow trusted vulnerability advisories for newly disclosed WordPress threats.