Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

The WooCommerce Wholesale Lead Capture plugin failed to validate file types in an AJAX handler, allowing unauthenticated attackers to upload malicious PHP web shells and achieve full remote code execution — no credentials required. Over 100,000 exploit attempts were blocked by Wordfence, underscoring how rapidly threat actors weaponize known plugin vulnerabilities in widely-deployed platforms like WordPress. This flaw highlights the danger of missing input validation on file upload endpoints, a long-understood but frequently overlooked secure coding practice. When unpatched plugins remain in production, a single vulnerable component can compromise an entire web server and its underlying data.