Critical Unauthenticated File Upload Flaw in WooCommerce Wholesale Lead Capture Enables Active PHP Web Shell Attacks
Attackers are actively exploiting a critical vulnerability in the premium WooCommerce Wholesale Lead Capture plugin to compromise WordPress sites and gain full control of the underlying server.
The flaw, identified as CVE-2026-27540 and rated CVSS 9.8, permits unauthenticated file uploads. Attackers can plant a PHP web shell and execute arbitrary commands remotely. The issue impacts all installations running version 2.0.3.1 and earlier.
The technical vector centers on the publicly accessible AJAX endpoint wwlc_file_upload_handler. This handler validates file extensions against an allowlist that an attacker can override by manipulating the file_settings parameter, enabling PHP files to be accepted. Once uploaded, the shell can be executed directly from the browser to deploy additional payloads, steal credentials, or establish persistence.
Telemetry shows more than 100,000 exploitation attempts blocked since June 2026, with notable spikes between 4–17 June, on 1 July, and on 30 August. Multiple repeat IP addresses have generated tens of thousands of requests, consistent with automated scanning campaigns targeting vulnerable sites across the internet.
The developer published WooCommerce Wholesale Lead Capture 2.0.3.2 on 20 February 2026. Sites that cannot update immediately should disable or remove the plugin. Administrators must also scan wp-content/uploads for unexpected or recently created .php files and review logs for requests to /wp-admin/admin-ajax.php with the action wwlc_file_upload_handler.
Additional defensive measures include deploying WAF rules to block malicious uploads via admin-ajax.php and monitoring for repeated failed or successful requests from the same sources. In cases of confirmed intrusion, simply deleting a single file is insufficient; unknown administrator accounts should be removed, credentials rotated, and the site restored from a verified clean backup after hardening.
Related articles
GitSpawn Exposes Persistent Git Config Execution Risks in Coding Agents
Manifold Security released GitSpawn, detailing eight vulnerabilities across seven coding agents where opening a folder triggers arbitrary code execution via Git configuration before any user prompt. The core issue stems from the core.fsmonitor setting in .git/config, which Git executes during index updates like git status or git diff. While vendors including Anthropic patched Claude Code in version 2.1.196, the fix only blocks agent-initiated calls and leaves manual Git commands or other tools vulnerable. Additional vectors include nested bare repositories tracked under CVE-2026-45033 affecting GitHub Copilot CLI and unpatched agents such as Qwen Code and Grok Build. The researcher also released the Stroq tool to inspect repositories for dangerous settings like core.fsmonitor and postinstall scripts before opening them. The findings highlight that repository trust mechanisms from 2021 remain bypassed by modern AI coding tools.
AWS Systems Manager Agent Flaw Allows Bypass of Port Forwarding Restrictions
Amazon has fixed a vulnerability in the AWS Systems Manager agent that permits an authenticated attacker to bypass restrictions on port forwarding sessions. The issue, tracked as CVE-2026-89049, stems from inadequate validation of equivalent representations of blocked link-local addresses. As a result, attackers can reach the EC2 instance metadata service at 169.254.169.254 and obtain temporary credentials tied to the instance's IAM role. Affected versions are those prior to 3.3.4851.0, with the fix included in that release and all subsequent versions. AWS recommends reviewing custom builds of the agent, restricting access to the AWS-StartPortForwardingSessionToRemoteHost document, auditing Session Manager activity, and applying least-privilege principles to IAM roles.
Vulnerability Management in Atypical Environments: ICS, Networks, IoT, Mobile, Hardware, and ML Systems
Vulnerability management follows the same core process across environments—identify assets, scan, assess risk, prioritize, remediate, and verify—but each domain introduces critical constraints. In industrial control systems, scanning must avoid disrupting physical processes, requiring audit-mode authenticated scans, digital twins for testing, and strict change windows. Network devices frequently suffer from poor segmentation, default SNMP community strings, and exposed management interfaces that enable traffic redirection or configuration tampering. IoT ecosystems remain plagued by default credentials, as demonstrated by the Mirai botnet that took down major DNS infrastructure in 2016, while modern botnets like Reaper and VPNFilter exploit unpatched firmware at massive scale. Machine learning systems face novel threats including prompt injection, prompt leaking, and jailbreaking that can bypass safety controls or exfiltrate training data. Mobile platforms suffer from extreme fragmentation that prevents timely patching of vulnerabilities such as Stagefright, Pegasus, and BlueBorne. Hardware-level flaws like Spectre, Meltdown, and BadUSB demonstrate that even firmware and silicon require coordinated microcode, OS, and application updates.
Google Issues Chrome 153 Security Update Addressing 42 Vulnerabilities Including Three Critical Flaws
Google has released a major security update for its Chrome browser version 153, fixing a total of 42 vulnerabilities. The update includes three critical-severity issues that could allow attackers to execute arbitrary code or cause memory corruption. Patches are now available for Windows, macOS, and Linux platforms, with versions 153.0.8010.48 and 153.0.8010.47. Among the critical fixes are out-of-bounds read in WebGL, use-after-free in Internals, and another use-after-free in Workers. The release also resolves 28 high-severity flaws affecting the V8 JavaScript engine, ServiceWorker, Skia, DOM, PDF, and other components. Medium and low severity issues were addressed as well, bringing the total to 42 vulnerabilities resolved.