importantSYS.SOURCE: The Hacker News• 2026-09-16T11:18:28+05:30

Critical WooCommerce Plugin Vulnerability Exploited for PHP Web Shell Deployment

#wordpress #vulnerability #web security

A critical vulnerability in the WooCommerce Wholesale Lead Capture plugin (CVE-2026-27540) allows unauthenticated attackers to upload PHP web shells for remote code execution. Two additional critical flaws in The Events Calendar plugin were also disclosed, enabling unauthorized remote code execution and potential site takeovers.

Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs.

"This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution," Wordfence said.

The WordPress security company said it has blocked over

Read original article

*** END OF TRANSMISSION ***

> PROGRAMMING FUNDAMENTALS IN THE ERA OF LARGE LANGUAGE MODELS > CYCLE-ACCURATE IBM PC/XT EMULATOR WITH DEBUGGING TOOLS AND HARDWARE RESEARCH > CRITICAL WOOCOMMERCE PLUGIN VULNERABILITY EXPLOITED FOR PHP WEB SHELL DEPLOYMENT > REAL-TIME GPS MOVING MAP DISPLAY ON 25MHZ 486-SX EMBEDDED SYSTEM > CRITICAL JWT BYPASS VULNERABILITY IN WSO2 API MANAGER UNDER ACTIVE EXPLOITATION > DATAMIMIC: CONTROLLED SYNTHETIC TEST DATA GENERATION FOR REGULATED ENTERPRISES > NEGATIVLAND'S CULTURE JAMMING AND COPYRIGHT ADVOCACY IN MULTIMEDIA ART > BALANCING SEARCH VISIBILITY AND AI TRAINING RESTRICTIONS WITH CLOUDFLARE'S BOT MANAGEMENT > APPLE'S REFERENCE IMAGE TECHNOLOGY FOR SECURE PHOTOGRAPHIC VERIFICATION > NVIDIA CEO JENSEN HUANG ADVOCATES AGAINST AI REGULATION, EMPHASIZES INDUSTRY SELF-RESPONSIBILITY> PROGRAMMING FUNDAMENTALS IN THE ERA OF LARGE LANGUAGE MODELS > CYCLE-ACCURATE IBM PC/XT EMULATOR WITH DEBUGGING TOOLS AND HARDWARE RESEARCH > CRITICAL WOOCOMMERCE PLUGIN VULNERABILITY EXPLOITED FOR PHP WEB SHELL DEPLOYMENT > REAL-TIME GPS MOVING MAP DISPLAY ON 25MHZ 486-SX EMBEDDED SYSTEM > CRITICAL JWT BYPASS VULNERABILITY IN WSO2 API MANAGER UNDER ACTIVE EXPLOITATION > DATAMIMIC: CONTROLLED SYNTHETIC TEST DATA GENERATION FOR REGULATED ENTERPRISES > NEGATIVLAND'S CULTURE JAMMING AND COPYRIGHT ADVOCACY IN MULTIMEDIA ART > BALANCING SEARCH VISIBILITY AND AI TRAINING RESTRICTIONS WITH CLOUDFLARE'S BOT MANAGEMENT > APPLE'S REFERENCE IMAGE TECHNOLOGY FOR SECURE PHOTOGRAPHIC VERIFICATION > NVIDIA CEO JENSEN HUANG ADVOCATES AGAINST AI REGULATION, EMPHASIZES INDUSTRY SELF-RESPONSIBILITY