Act
active
WooCommerce Wholesale Lead Capture Plugin Exploited for RCE
- Engineer — Act: Unauthenticated file upload enabling PHP web shell deployment is being actively exploited against this WooCommerce plugin (~6,000 installs). Check all WordPress sites for this plugin, update to the patched version immediately, and audit the uploads directory for unexpected PHP files.
- SOC/IR — Act: Active exploitation is planting PHP backdoors on WordPress sites; sweep web servers for anomalous PHP files in WooCommerce plugin upload paths and hunt for POST requests to the plugin’s file-upload endpoint since exploitation began.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.