CVE-2026-27542

CriticalCVSS 9.8

Published: 19/03/2026(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.78%

78th percentile - higher than 78% of all known CVEs

Summary

The WooCommerce Wholesale Lead Capture plugin (through version 2.0.3.1) contains an incorrect privilege assignment vulnerability. This may lead to privilege escalation.

Risk Assessment

A low-privileged user could gain higher privileges on the site, potentially resulting in unauthorized access to administrative functions.

Recommendation

Update the WooCommerce Wholesale Lead Capture plugin to a version later than 2.0.3.1 or disable it if no update is available.

Other vulnerabilities in WooCommerce Wholesale Lead Capture

CVE-2026-27540Critical
The WooCommerce Wholesale Lead Capture plugin (through version 2.0.3.1) allows unrestricted upload of files with dangerous types. This enables an attacker to upload a malicious file to the server.

Original NVD description (English source)

Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Privilege Escalation. This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS