WooCommerce Plugin Flaw Exploited: What Stores Should Do

On September 14, 2026, the WordPress security firm Wordfence published attack data showing that a critical flaw in a paid WooCommerce plugin is being actively exploited. The plugin is Wholesale Lead Capture for WooCommerce, used by an estimated 6,000 sites to run wholesale or reseller registration forms. A fixed version has been available since February. What makes this worth ten minutes of your morning is the gap in between: Wordfence reports blocking more than 100,000 exploit attempts, with heavy waves in June, July, and again on August 30 — months after the patch shipped. If your store takes applications from resellers, sari-sari store owners, or corporate accounts through a signup form, check it today. If it does not, the routine at the end still applies to every paid plugin you run.

Which Stores Are Affected

The vulnerability is tracked as CVE-2026-27540 and rated 9.8 on the CVSS severity scale. It affects all versions of the plugin up to and including 2.0.3.1, and is fixed in version 2.0.3.2. In plain terms: the wholesale registration form accepts file uploads, which is normal — a supplier might ask an applicant for a business permit or a BIR certificate. The form checked whether the uploaded file type was allowed, but it read the list of allowed types from the request itself rather than from the store's own settings. An attacker could therefore submit their own list, add PHP to it, and upload a PHP file. No login was needed. The uploaded file in the observed attacks was a web shell: a small script that adds its own upload form, so the attacker can write more files at will. From there, a compromise can extend to new administrator accounts, customer data, or the whole site.

Why a Patched Plugin Stays Unpatched

The more useful question is why so many stores can stay exposed months after a fix is published. For paid plugins, three ordinary situations can plausibly explain a gap like this, though none of them has been confirmed as the specific cause in this incident. First, licensing. Free plugins from the WordPress directory announce their own updates. Paid ones check in with the vendor using a licence key, and when that licence lapses the dashboard can stop offering the update. The plugin keeps working, so nothing looks wrong. Second, ownership. Many Philippine stores were built by a freelancer, an agency, or a relative who is good with computers, and the licence was bought with their email address. Two years later nobody remembers whose renewal reminder it was. Third, unused features. A wholesale form set up for a plan that never took off still sits on a page, still loads, and still accepts requests.

Checking Your Store Today

Three checks, in this order. The first takes a minute; the others are worth doing even if the first one goes smoothly.

Update the Plugin First

If Wholesale Lead Capture is installed, get it to 2.0.3.2 or later. If the dashboard shows no update available, that may be a licence question rather than a sign you are current — sign in to the vendor account, check the licence status, and download the latest version directly if needed. Where a developer manages your site, forward them the version number. Updating closes the flaw, but it does not remove a web shell or backdoor that may already have been uploaded. If you have any reason to suspect the plugin was exploited before you updated, treat it as a possible compromise and investigate — do not rely on the update alone to clean the site.

Look for Files You Did Not Upload

Because a successful attack writes an executable file to the server, Wordfence recommends reviewing your site for unexpected or recently created .php files, particularly inside the uploads directory. Your hosting file manager or an FTP client will show these; sort by modified date and look at anything recent. Filenames such as shell.php were common in the observed attacks, though any name is possible.

Read Your Access Logs

Access logs record what was requested and when, but a standard web-server access log typically shows only that /wp-admin/admin-ajax.php was requested — not the POST action parameter inside it, such as wwlc_file_upload_handler. Searching a plain access log for that action name may turn up nothing even on a targeted site. If your host keeps a WAF or security log that records full request details, search that instead, or ask your hosting provider or a security specialist to check for that action on your behalf. One caveat from the same advisory: finding nothing in your logs does not prove your site was never touched. Logs rotate, retention varies, and a standard access log may not have captured the request detail in the first place. Clean checks plus a current plugin is a good position, not a certificate.

If You Find Something

Finding a file you did not upload is unwelcome, and survivable. Deleting it and moving on is the response to avoid, because the file is the symptom rather than the cause.

• Keep a copy first. Snapshot the site as it is, infection included, so you can trace how the file arrived.
• Reset access widely. WordPress administrators, FTP, the hosting control panel, and the database user — for everyone with access, not only yourself. Database credentials must be changed in step with your WordPress configuration file, so have a qualified administrator or your hosting provider coordinate this change rather than editing the database alone.
• Remove what should not be there. Unexpected files and administrator accounts nobody created, then look for other backdoors rather than assuming there was one.
• Tell your hosting provider. On shared hosting they can see things you cannot. For Z.com customers that starts at the Help Center.

The official WordPress guidance for hacked sites covers the full sequence, including regenerating the secret keys in wp-config.php so anyone already signed in is signed out. For a store taking live orders, paying a specialist to clean it properly is usually money well spent.

Keeping Licensed Plugins Current

This incident is a good prompt for a short piece of housekeeping that pays off repeatedly. Write down every paid plugin and theme on your store, with the vendor, the licence owner, and the renewal date, and put those renewals in the same calendar as your domain and hosting. When a licence belongs to a developer you no longer work with, move it to a business email address you control — the same one on your WordPress hosting account. Then delete what you do not use. Deactivating leaves the files on the server and the plugin in the category of things you might need again. A wholesale form you abandoned, a contact form replaced by Messenger, a gallery from an old theme — removing them shortens the list you keep current. Finally, give updates a time and a place. Once a month, apply plugin updates on a staging copy, click through checkout and your enquiry forms, then repeat on the live store. Z.com WordPress Hosting includes daily automated backups and a staging site, so you can rehearse an update before customers see it.

Frequently Asked Questions