Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Threat actors are exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin to upload PHP web shells and achieve remote code execution. Wordfence has blocked over 100,000 attempts since June 2026. Additionally, a separate, critical vulnerability within The Events Calendar plugin is also being exploited, leading to potential site takeover and data theft.
A critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with over 6,000 active installs, is being exploited by threat actors to upload PHP web shells and achieve remote code execution. Wordfence reported that it has blocked over 100,000 exploit attempts since June 2026, with 99 of those attempts recorded in the last 24 hours. The vulnerability stems from a missing file type validation in the "wwlc_file_upload_handler" AJAX action, impacting all versions of the plugin up to and including 2.0.3.1. Attackers are submitting crafted requests with a forged file_settings parameter and a malicious PHP file ("shell.php"), which then allows them to upload arbitrary PHP files and establish remote code execution.
Wordfence has also identified a separate, critical vulnerability within The Events Calendar, a WordPress plugin installed on over 600,000 websites. Successful exploitation requires the target event page to have comments enabled and the plugin's "Show comments on event pages" option to be active. The vulnerability, tracked as CVE-2026-78159 (CVSS score: 9.8), arises from insufficient validation of the widget 'classes' map in the "parse_array" function, leading to unauthenticated remote code execution. Another vulnerability, CVE-2026-78006 (CVSS score: 9.8), stems from insufficient protection in the "is_safe_widget_instance" function, also resulting in unauthenticated remote code execution. Both chains begin in the plugin’s widget-rendering pipeline and can ultimately lead to remote code execution without authentication through two separate methods. The first chain uses PHP Object Injection to execute arbitrary operating system commands on the underlying server, while the second chain bypasses the object-injection guard and abuses an arbitrary-callable primitive to reset an administrator’s password, enabling further malicious plugin uploads and complete site control. StellarWP has addressed these flaws in version 6.17.3.1 and 6.17.4.1, respectively.