CVE-2026-27540 - Vulnerability Analysis

Overview

Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture <= 2.0.3.1 contains an unrestricted file upload vulnerability caused by insufficient validation of uploaded file types, letting attackers upload malicious files remotely, exploit requires no special privileges.

Severity & Score

Impact

Attackers can upload malicious files, potentially leading to remote code execution or server compromise.

Mitigation

Update to the latest version beyond 2.0.3.1.

References

• https://x.com/Nxploited/status/2026761480004137364
• https://patchstack.com/database/wordpress/plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability
• https://patchstack.com/database/wordpress/plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner