WooCommerce Wholesale Lead Capture Exploited in the Wild

TL;DR

Threat actors are actively exploiting a critical flaw in the WooCommerce Wholesale Lead Capture plugin across thousands of websites. The weakness allows unauthenticated remote attackers to upload arbitrary PHP scripts and seize server control. Administrators must update the plugin immediately to block ongoing malicious intrusion attempts.

Why This Threat Matters

Sourced estimates show that approximately 6,000 WordPress websites actively run this commercial extension. Many business-to-business merchants depend on the tool to register prospective wholesale buyers. Therefore, security defects in this software expose merchant operations to severe harm. If an attacker breaches the server, they can access private customer records and financial data. Furthermore, intruders can inject payment skimmers into checkout pages or hijack administrator privileges. Wordfence confirmed intense threat activity, noting that “the Wordfence Firewall has already blocked over 100,000 exploit attempts targeting this vulnerability.”

How the Attack Works

The security issue stems from missing server-side input validation during file uploads. Specifically, the software exposes a public AJAX endpoint named wwlc_file_upload_handler to process registration attachments. Unauthenticated visitors can access this handler directly from the web.

The official advisory explains, “The Wholesale Lead Capture Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.0.3.1.”

During execution, the handler attempts to restrict file extensions against an allowed list. However, the software extracts this allowed list directly from user-supplied request parameters rather than trusted server configuration. The researchers explained that “because the check relies on this attacker-controlled value, an unauthenticated attacker can simply include php in their own list of allowed file types to bypass the restriction and upload a file with a .php extension.”

As a result, remote actors supply forged parameters containing executable extensions alongside webshell scripts.

Affected Versions

This critical vulnerability impacts all software releases up to and including version 2.0.3.1. Researchers have confirmed active in-the-wild exploitation across multiple hosting providers. In addition, public technical analysis and request samples are readily available online.

Patch and Mitigation Steps

Store operators must upgrade their websites immediately to protect their systems. The development team addressed the issue by releasing version 2.0.3.2. Therefore, administrators should install the updated plugin without delay.

Additionally, security teams must examine their website directories for unfamiliar PHP files. Administrators should check the standard uploads directory for suspicious scripts such as shell.php. Finally, teams should inspect web server access logs for repeated calls to the vulnerable AJAX handler.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.