Two critical WordPress plugin vulnerabilities are making the rounds. One is being actively exploited right now. The other is a pair of flaws that could let an attacker take over your site without a password.

Wordfence published the details. Let me walk you through what's happening and what you need to do.

Quick Summary

WooCommerce Wholesale Lead Capture: The File Upload Bug

The plugin is a premium WordPress extension. It has over 6,000 active installs. And it has a serious problem.

CVE-2026-27540 is an arbitrary file upload vulnerability. The issue is a missing file type check in an AJAX action called wwlc_file_upload_handler. That flaw affects every version up to and including 2.0.3.1.

An unauthenticated attacker can upload any file they want to your server. Including PHP backdoors. That leads to remote code execution.

Wordfence says it has blocked over 100,000 exploit attempts since June 2026. Just 99 of those were in the last 24 hours. So the attacks are ongoing.

How the attack works:

Attackers send a crafted request to the wwlc_file_upload_handler AJAX action. They include a forged file_settings parameter and a malicious PHP file called shell.php.

Once uploaded, that PHP file acts as a web shell. It reports host details. It offers a browser-based upload form for writing more malicious files to your site.

IP addresses to watch:

• 92.241.13.213
• 31.59.129.150
• 2a0f:85c1:840:5389::1
• 92.241.13.140
• 23.137.105.214
• 23.180.120.140
• 104.194.9.138
• 187.75.114.36
• 114.10.43.203
• 37.114.144.209

If you see these in your logs, you've been targeted.

The Events Calendar: Two Chains, One Bad Outcome

The Events Calendar is a much bigger plugin. Over 600,000 websites use it. And it has two critical vulnerabilities.

Both are rated 9.8. Both allow unauthenticated remote code execution. But they work a bit differently.

• CVE-2026-78159 affects versions up to 6.17.3. It's an insufficient validation issue in the widget classes map in the parse_array function. That leads to remote code execution.
• CVE-2026-78006 affects versions up to 6.17.4. It's an insufficient protection issue in the is_safe_widget_instance function. That also leads to remote code execution.

What's the catch?

Both chains require two conditions. The target event page must have comments enabled. And the plugin's "Show comments on event pages" option must be active.

If those are true, an attacker can trigger the chains through WordPress's pending-comment preview. No moderator approval needed.

The two chains:

• The first chain uses PHP Object Injection. That lets the attacker execute arbitrary OS commands on your server.
• The second chain bypasses the object-injection guard. It abuses an arbitrary-callable primitive to reset an administrator's password. Once the attacker has admin access, they can upload a malicious plugin and take complete control of the site.

Both flaws have been fixed. CVE-2026-78159 is patched in 6.17.3.1. CVE-2026-78006 is patched in 6.17.4.1.

What You Should Do

1. Update.

WooCommerce Wholesale Lead Capture: update from 2.0.3.1. There is no official fixed version available yet, so contact the vendor.

Event Calendar: update to version 6.17.3.1 or 6.17.4.1 according to the exploited vulnerability.

2. Check for webshells.

Check for suspicious php files, particularly new ones. Normally they appear in the uploads directory. Webshell creates shell.php through the WooCommerce vulnerability.

3. Examine your logs.

Requests to /wp-admin/admin-ajax.php?action=wwlc_file_upload_handler for the WooCommerce exploit, requests coming from IP addresses from above. Requests related to comment previews for The Events Calendar.

4. Check your admin accounts.

In case you think The Events Calendar vulnerability has been used, check for any new admin accounts. Check for password changes that you have not done.

5. Check plugins.

Unexpected plugins, file integrity and unexpected modifications.

6. Consider a WAF.

A web application firewall can help block some of these attacks. But it's not a substitute for patching.

The Bottom Line

Two WordPress plugin families have critical vulnerabilities. WooCommerce Wholesale Lead Capture is being actively exploited. The Events Calendar has two chains that lead to full site takeover. Patch now. Check for compromise. Don't wait.

Quick Reference:

What to Do:

• Update immediately
• Check for webshells
• Review logs for IPs
• Check admin accounts
• Audit plugins
• Consider a WAF

FAQ Section

What is CVE-2026-27540?

An arbitrary file upload vulnerability in WooCommerce Wholesale Lead Capture. It allows unauthenticated attackers to upload PHP backdoors and achieve remote code execution.

What is the WooCommerce Wholesale Lead Capture plugin?

A premium WordPress plugin for wholesale lead capture. It has over 6,000 active installs.

What are the The Events Calendar vulnerabilities?

CVE-2026-78159 and CVE-2026-78006. Both allow unauthenticated remote code execution via the plugin's widget-rendering pipeline.

Is there a need for comments to exploit The Events Calendar vulnerability?

Yes. It is important to enable comments on the event page targeted and to check the box "Show comments on event pages".

How can I tell if I'm compromised?

There will be an unexpected .php file in the uploads directory. There will be a request to admin-ajax.php with wwlc_file_upload_handler action. There may be unexpected admin accounts.

What should I do?

Patch immediately. Check for webshells. Review logs. Audit plugins. Consider a WAF.

Source: The Hacker News