CVE-2026-27540
CriticalCVSS 9.0Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
The WooCommerce Wholesale Lead Capture plugin (through version 2.0.3.1) allows unrestricted upload of files with dangerous types. This enables an attacker to upload a malicious file to the server.
Risk Assessment
An attacker could upload a malicious file (e.g., a PHP script), potentially leading to code execution and compromise of the WordPress/WooCommerce site.
Recommendation
Update the WooCommerce Wholesale Lead Capture plugin to a version later than 2.0.3.1 or disable it if no update is available.
Other vulnerabilities in WooCommerce Wholesale Lead Capture
Original NVD description (English source)
Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files. This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS