Ten IP Addresses Sent at Least 94,000 Attempts to Exploit a WooCommerce Plugin.

A critical flaw in WooCommerce Wholesale Lead Capture, a paid WooCommerce extension from Rymera Web Co that Wordfence estimates runs on about 6,000 sites, was disclosed on February 20, with version 2.0.3.2 named as the fix. Attackers are still trying. Wordfence reported on September 14 that its firewall has blocked more than 100,000 attempts to exploit the flaw since it was disclosed, and that the attempts have continued for months.

The flaw, CVE-2026-27540, lets an attacker who is not logged in upload a PHP file to the server and run it. A successful upload can place a web shell on a customer account, and on shared infrastructure that is the provider’s problem as much as the merchant’s. Two details in the published attack data matter more than the headline total: the largest spike came at the end of August, and the counts are concentrated in a short list of source addresses.

Key facts

• The flaw: an unauthenticated file upload in versions up to 2.0.3.1 that can lead to code execution, fixed in 2.0.3.2 and disclosed on February 20.
• Still running: Wordfence has blocked over 100,000 exploit attempts, with waves between June 4 and 17, on July 1 and on August 30.
• Concentrated: the minimum counts Wordfence publishes for ten source addresses add up to at least 94,490 blocked requests, with the first two contributing 48,900 of that.
• The update path: the extension is absent from the WordPress plugin directory, and its maker ties automatic updates to a license that runs for twelve months.

The Largest Published Spike Came on August 30

The attack volumes published with the report cover June, July and August, and they are easy to misread because each chart is drawn to its own scale. June runs to 10,000 requests a day and peaks a little below that between the 4th and the 17th. July runs to 8,000 and has one spike on the 1st. August runs to 50,000, and the spike on the 30th reaches most of the way up it, around 40,000 requests in a single day.

What the three charts establish is narrower than a trend. High-volume attempts had not stopped by late August, and of the dates shown, August 30 produced the largest spike, more than six months after disclosure.

Ten Addresses, at Least 94,490 Blocked Requests

The report names the ten addresses currently most active against the plugin, with a count for each, every one written as “over” some figure. Added up, those published minimums come to at least 94,490 blocked requests, with the first two contributing 48,900 to that published minimum subtotal. Wordfence does not say what period the per-address counts cover, so they cannot be set against the cumulative total of more than 100,000. Two of the ten sit in the same 92.241.13 range.

The published lower bounds sum to at least 94,490 requests, with at least 93,400 coming from the seven highest.
Source: Wordfence, September 14, 2026.

What that list is good for is looking backwards. It gives a provider something to hunt for in old logs and something to block for a while. It does not show that the activity is limited to ten machines, and a static block list is no substitute for patching. The requests target admin-ajax.php and carry the action wwlc_file_upload_handler in the body of a POST, so they appear in logs that record request contents rather than in an ordinary access log line. The other marker is an unexpected PHP file in the uploads directory, often named shell.php. Wordfence notes that finding no such entries does not prove a site is clean.

The List of Allowed File Types Came From the Attacker

The plugin builds wholesale registration forms, and those forms can accept file uploads. It exposes an AJAX action named wwlc_file_upload_handler, which visitors can reach without logging in.

The handler does check the extension of an uploaded file against a list of permitted types. The problem is where that list comes from. In the vulnerable versions it is read out of the request itself rather than from the form’s configuration on the server, so the person doing the uploading supplies the rule that is supposed to restrain them. Adding php to their own list is enough. The handler also turns off the separate check on file type that WordPress would otherwise apply.

A successful upload leaves a working PHP script on the server. In the cases Wordfence described, the uploaded file reports details about the host and presents a browser form for writing more files to the site, which is the standard opening for creating an administrator account or taking the site over entirely.

The flaw was reported by Teemu Saarentaus through the Patchstack bug bounty program. The two published severity ratings differ: the CVE record, which Patchstack assigned, scores it 9.0 out of 10, while Wordfence scores the same flaw 9.8. Both call it critical.

Updates Stop When the License Expires

How the plugin receives fixes is a separate matter for anyone running stores on shared hosting. It is sold by its vendor and is not published in the WordPress plugin directory, so its updates do not come through WordPress.org. Its maker, Wholesale Suite, states that a purchase brings one year of updates through the WordPress dashboard once a license key is entered, and that licenses run for twelve months on a renewing subscription. Updates do arrive automatically, then, but only while the license remains active. Neither the vendor nor Wordfence says how many installations are still on a vulnerable release.

Wordfence also set out its own timing: customers on its paid tiers received a firewall rule on February 27, and users of the free version received the same rule on March 29, thirty days later.

About the Data

Flaw description, versions, the 9.0 severity and the researcher credit come from the CVE record for CVE-2026-27540, which Patchstack assigned. The disclosure date, attack figures, source addresses, indicators of compromise, installation estimate and separate 9.8 rating come from Wordfence’s September 14 report, whose telemetry we cannot independently verify. The figure of more than 100,000 counts blocked requests, not compromised sites or successful break-ins, and no source says how many installations are still vulnerable. Patchstack published its entry on February 20 naming 2.0.3.2 as the fix and Wordfence later named the same version, but neither says when it shipped. The sums of published minimum counts and the reading of charts drawn to different scales are ours, as is the plugin directory check. License terms come from Wholesale Suite’s pricing page.