Atomic Edge analysis of CVE-2026-27540 (metadata-based):
The WooCommerce Wholesale Lead Capture plugin contains an unauthenticated arbitrary file upload vulnerability in all versions up to and including 2.0.3.1. This flaw exists in a file upload handler that lacks proper file type validation. Attackers can exploit this to upload malicious files directly to the server, potentially leading to remote code execution. The CVSS 3.1 score of 9.8 (Critical) reflects the network-based, unauthenticated attack vector with high impact on confidentiality, integrity, and availability.
Atomic Edge research indicates the root cause is CWE-434: Unrestricted Upload of File with Dangerous Type. The vulnerability description confirms missing file type validation in an upload function. Without examining source code, we infer the plugin likely implements a file upload feature for lead capture data or attachments. This feature probably uses WordPress’s AJAX handler (`admin-ajax.php`) or a custom endpoint without proper capability checks or nonce verification. The absence of authentication requirements suggests the vulnerable endpoint is intentionally accessible to unauthenticated users, possibly for public lead submission. The plugin fails to validate file extensions, MIME types, or file content before moving uploaded files to a web-accessible directory.
Exploitation requires sending a multipart/form-data POST request containing a malicious file to the vulnerable endpoint. Attackers likely target `/wp-admin/admin-ajax.php` with an `action` parameter corresponding to the plugin’s upload handler. The action name may derive from the plugin slug, such as `wwlc_upload_file` or `wholesale_lead_capture_upload`. Alternatively, the plugin may expose a direct endpoint like `/wp-content/plugins/woocommerce-wholesale-lead-capture/upload.php`. The attacker uploads a file with a double extension (e.g., `shell.php.jpg`) or a pure `.php` file if the server executes PHP in upload directories. The payload could be a web shell like “. Successful upload provides a direct URL to the malicious file, enabling remote code execution.
Remediation requires implementing strict file upload validation. The patched version 2.0.3.2 likely added server-side file type verification using allowed extension lists and MIME type checking. Proper fixes also include storing uploaded files outside the web root or in directories with disabled script execution via `.htaccess` or `nginx` configuration. The plugin should enforce authentication and capability checks for upload functions, or at minimum implement WordPress nonce verification for public endpoints. Atomic Edge analysis recommends validating file content signatures in addition to extensions to prevent file type spoofing.
Successful exploitation grants attackers the ability to upload arbitrary files, including PHP web shells, to the target server. This directly leads to remote code execution with the web server’s permissions (typically `www-data` or `nobody`). Attackers can execute operating system commands, access databases, deface websites, install backdoors, or pivot to internal networks. The unauthenticated nature broadens the attack surface to any visitor. Compromise severity depends on server configuration and file upload directory permissions. Even without script execution, attackers could upload HTML files for phishing campaigns or large files to cause denial of service through disk consumption.
