Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd.

CVE-2026-27540 is an unrestricted file upload in the WooCommerce Wholesale Lead Capture plugin (a premium WordPress plugin by Rymera Web Co / Wholesale Suite) affecting all versions through 2.0.3.1. The vulnerable AJAX handler wwlc_file_upload_handler accepts a client-supplied file_settings parameter that overrides the server-side allowed-extensions list. An unauthenticated attacker sends a crafted multipart POST to wp-admin/admin-ajax.php with action=wwlc_file_upload_handler, sets permitted extensions to include .php, and uploads a webshell. No authentication, no user interaction, no race condition — it's a straight shot to remote code execution under the web server's process context.

The vendor's CRITICAL/9.0 score (some sources cite 9.8 with AC:L) is technically accurate for the vulnerability mechanics — unauthenticated RCE via trivial HTTP request is textbook critical. However, the score does not capture the real-world exposure surface: this is a premium niche plugin with roughly 6,000 active installations globally. For an enterprise fleet of 10,000 hosts, the probability of running this plugin is near zero unless the organization operates WooCommerce-based wholesale storefronts. The active exploitation campaign (100,000+ blocked attempts documented by Wordfence from February through August 2026) confirms weaponization is real, but the blast radius per compromised site is limited to that single WordPress instance — there is no lateral-movement multiplier, no domain escalation, no supply-chain pivot inherent to the plugin's role.

Why this verdict

• Unauthenticated RCE with trivial exploit: No credentials, no user interaction, single HTTP request. Public PoCs are available and exploitation is actively occurring — this is the floor-setting factor that prevents any downgrade below HIGH.
• Tiny global install base: ~6,000 active installations of a premium niche WooCommerce plugin. For an enterprise managing 10,000 hosts, the odds of running this plugin are negligible unless the organization specifically operates wholesale B2B storefronts on WordPress.
• Single-site blast radius: Compromise yields web-server-level access to one WordPress instance. No domain controller, no fleet propagation, no supply-chain pivot. The worst secondary outcome is shared-hosting lateral movement, which is environment-dependent.
• Role multiplier: WordPress with a WooCommerce wholesale plugin occupies role (b) at best — a line-of-business web storefront. It is not an identity provider, hypervisor, backup server, CI/CD system, or network edge appliance. The compromised site may hold customer PII and payment metadata (blast radius: tenant-level data breach), but this does not reach domain/fleet/supply-chain scale. The floor for HIGH is met by the active exploitation of unauth RCE; the floor for CRITICAL is NOT met because the component is not canonically high-value-role software and <0.01% of the enterprise server fleet runs it.
• Active exploitation confirmed but not KEV-listed: Wordfence has blocked 100,000+ attempts across multiple campaigns from Feb–Aug 2026. The lack of KEV listing is likely due to CISA's focus on vendor products rather than third-party WordPress plugins, not an indicator of low risk.

Why not higher?

CRITICAL would be appropriate if this plugin were widely deployed infrastructure software (e.g., a core WordPress component affecting millions of sites) or if the compromised component occupied a high-value role like an identity provider or hypervisor. With only ~6,000 global installations and single-site blast radius limited to web-server-user context, the exposure population and impact ceiling do not justify CRITICAL for enterprise prioritization. The AC:H in the user-provided CVSS vector (if accurate) would further reduce severity, though most public sources report AC:L.

Why not lower?

Active unauthenticated RCE with confirmed exploitation campaigns involving 100,000+ attempts is a hard floor for HIGH. The exploit is trivial (single curl command), PoCs are public, and attackers are actively scanning for this specific plugin. Any organization that does run this plugin faces immediate, no-skill-required compromise. Downgrading to MEDIUM would be irresponsible given the confirmed weaponization.

1. Block the AJAX action at WAF/reverse proxy — Add a WAF rule to deny any POST to admin-ajax.php containing action=wwlc_file_upload_handler in the request body. This neutralizes the attack vector entirely without breaking core plugin functionality for existing registered users. Deploy within 30 days per noisgate mitigation SLA for HIGH, or immediately if you have confirmed installations.
2. Disable PHP execution in uploads directory — Add php_flag engine off in .htaccess or equivalent Nginx location block for wp-content/uploads/. This prevents any uploaded PHP file from executing, converting the file upload into a harmless file-write. This is a defense-in-depth measure that should already be in place on hardened WordPress deployments.
3. Update to version 2.0.3.2 — Apply the vendor patch via the Wholesale Suite commercial update channel. This is the definitive fix. Target completion within 30 days (noisgate mitigation SLA for HIGH).
4. Audit uploads directory for existing webshells — Search wp-content/uploads/ for .php files that should not exist. Check web server access logs for POST requests to admin-ajax.php with wwlc_file_upload_handler followed by GET requests to files in the uploads directory. Cross-reference against published IOC IPs (92.241.13.213, 31.59.129.150, etc.).

Run this on each WordPress host (or via SSH across your fleet) as any user with read access to the WordPress installation directory. Usage: bash check_cve_2026_27540.sh /var/www/html where the argument is the WordPress root directory. No elevated privileges required.

#!/bin/bash
# CVE-2026-27540 checker — WooCommerce Wholesale Lead Capture
# Usage: bash check_cve_2026_27540.sh /path/to/wordpress
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

WP_ROOT="${1:-.}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/woocommerce-wholesale-lead-capture"

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "UNKNOWN — WooCommerce Wholesale Lead Capture plugin not found at $PLUGIN_DIR"
  exit 2
fi

# Extract version from the main plugin file header
MAIN_FILE="$PLUGIN_DIR/woocommerce-wholesale-lead-capture.php"
if [ ! -f "$MAIN_FILE" ]; then
  echo "UNKNOWN — Main plugin file not found"
  exit 2
fi

VERSION=$(grep -i 'Version:' "$MAIN_FILE" | head -1 | sed 's/.*Version:[[:space:]]*//' | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not extract plugin version"
  exit 2
fi

echo "Detected WooCommerce Wholesale Lead Capture version: $VERSION"

# Compare version — vulnerable if <= 2.0.3.1
# Use sort -V for version comparison
FIXED="2.0.3.2"
LOWEST=$(printf '%s\n%s' "$VERSION" "$FIXED" | sort -V | head -1)

if [ "$VERSION" = "$FIXED" ] || [ "$LOWEST" = "$FIXED" ]; then
  echo "PATCHED — Version $VERSION >= $FIXED"
  exit 0
else
  echo "VULNERABLE — Version $VERSION is below fixed version $FIXED (CVE-2026-27540)"
  # Bonus: check for existing webshells in uploads
  UPLOADS="$WP_ROOT/wp-content/uploads"
  if [ -d "$UPLOADS" ]; then
    SHELLS=$(find "$UPLOADS" -name '*.php' -type f 2>/dev/null | wc -l)
    if [ "$SHELLS" -gt 0 ]; then
      echo "WARNING: Found $SHELLS .php file(s) in uploads directory — possible compromise!"
      find "$UPLOADS" -name '*.php' -type f 2>/dev/null
    fi
  fi
  exit 1
fi

Sources

1. GBHackers — Active Exploitation of WooCommerce Wholesale Lead Capture
2. NVD — CVE-2026-27540 Detail
3. Rapid7 — CVE-2026-27540 Vulnerability Database
4. Exploit Intel — CVE-2026-27540 Analysis
5. Wholesale Suite — Plugin Changelog
6. OpenCVE — CVE-2026-27540
7. SecurityOnline — WooCommerce Wholesale Lead Capture Exploited in the Wild