[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRk9px1XnzSoLP_4GoYR5XCb78-2igfhi3hOzyw4iJJ4":3},{"article":4,"iocs":39,"watch_terms":66,"solutions":67,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"26e3aec4-d771-449c-ac60-bc6e25219380","Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells","attackers-exploit-woocommerce-wholesale-lead-capture-flaw-to-plant-php-web-shell-eee1a3","Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. \"This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution,\" Wordfence said. The WordPress security company said it has blocked over","Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin, allowing unauthenticated attackers to upload arbitrary files, including PHP backdoors, leading to remote code execution. Wordfence has blocked over 100,000 exploit attempts since June 2026. The vulnerability, CVE-2026-27540, affects all versions up to 2.0.3.1 and involves missing file type validation in an AJAX handler.","Attackers exploit WooCommerce Wholesale Lead Capture flaw to plant PHP web shells.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fattackers-exploit-woocommerce-wholesale.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhaDJy8WPrkf8CE0D66EluNlAxZjtSyl-SeLt9BmCzqINPxm9H08ACj6o1nZWYQxcR5FYK-RrzDRXe014EEAMDH1wBa-SSXV1HNXJyLZsOWzNxU533Err9iI0Z_PQwy2Z6pY3LkGMSB2xKwQPIJe5mXgCJFeeUGj8qDKSmA9I9RS0MNl7jtlUhqkVPOkIfL\u002Fs1600\u002Fwordpress-shell.jpg","2026-09-16T05:48:28+00:00","2026-09-16T08:00:08.232377+00:00",9,[17,20,23],{"name":18,"type":19},"WooCommerce Wholesale Lead Capture","product",{"name":21,"type":22},"Wordfence","vendor",{"name":24,"type":25},"WordPress","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[40,44,48,50,52,54,56,58,60,62,64],{"type":41,"value":42,"context":43},"cve","CVE-2026-27540","WooCommerce Wholesale Lead Capture arbitrary file upload vulnerability",{"type":45,"value":46,"context":47},"ip","92.241.13.213","Source IP address of exploit attempts",{"type":45,"value":49,"context":47},"31.59.129.150",{"type":45,"value":51,"context":47},"2a0f:85c1:840:5389::1",{"type":45,"value":53,"context":47},"92.241.13.140",{"type":45,"value":55,"context":47},"23.137.105.214",{"type":45,"value":57,"context":47},"23.180.120.140",{"type":45,"value":59,"context":47},"104.194.9.138",{"type":45,"value":61,"context":47},"187.75.114.36",{"type":45,"value":63,"context":47},"114.10.43.203",{"type":45,"value":65,"context":47},"37.114.144.209",[21,18],{"controls":68,"vendors":127},[69,98],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":99,"name":100,"problem":101,"products":102},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[],{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":144},"unpatched-woocommerce-plugin-lets-attackers-upload-php-backdoors","Unpatched WooCommerce Plugin Lets Attackers Upload PHP Backdoors","The WooCommerce Wholesale Lead Capture plugin failed to validate file types in an AJAX handler, allowing unauthenticated attackers to upload malicious PHP web shells and achieve full remote code execution — no credentials required. Over 100,000 exploit attempts were blocked by Wordfence, underscoring how rapidly threat actors weaponize known plugin vulnerabilities in widely-deployed platforms like WordPress. This flaw highlights the danger of missing input validation on file upload endpoints, a long-understood but frequently overlooked secure coding practice. When unpatched plugins remain in production, a single vulnerable component can compromise an entire web server and its underlying data.",[133,134,135,136,137,138,139,140,141,142,143],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AU-12: Audit Record Generation","OWASP Top 10 A05:2021 – Security Misconfiguration","OWASP Top 10 A08:2021 – Software and Data Integrity Failures","GDPR Article 32: Security of Processing (for sites handling EU personal data)","ITIL Change Management: Emergency Change procedures for critical patch deployment",{}]