Is Woocommerce Wholesale Lead Capture affected by CVE-2026-27540?

A critical vulnerability in the WooCommerce Wholesale Lead Capture plugin allows unauthenticated attackers to upload and execute malicious code on affected WordPress sites, potentially leading to complete system compromise and data breach.

CVE-2026-27540

EUVD-2026-13059 CRITICAL

2026-03-19 Patchstack

9.0

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 19, 2026 - 06:00 vuln.today

EUVD ID Assigned

Mar 19, 2026 - 06:00 euvd

EUVD-2026-13059

CVE Published

Mar 19, 2026 - 05:24 nvd

CRITICAL 9.0

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through 2.0.3.1.

Analysis

An unrestricted file upload vulnerability exists in the Woocommerce Wholesale Lead Capture plugin for WordPress, allowing remote attackers to upload and execute malicious files without authentication. The vulnerability affects all versions through 2.0.3.1 of the plugin developed by Rymera Web Co Pty Ltd. …

Remediation

Within 24 hours: Identify all WordPress instances using the vulnerable plugin and disable or remove it immediately; isolate affected systems from critical business processes if removal is not immediately feasible. Within 7 days: Conduct forensic analysis of affected systems for signs of compromise, reset all administrative credentials, and review access logs for unauthorized activity. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.0

CVSS: +45

POC: 0

CVE-2026-27540 vulnerability details – vuln.today

Back

CVE-2026-27540

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Analysis

Full analysis requires sign-in

Priority Score

Share

CVE-2026-27540

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Full analysis requires sign-in

Priority Score

Share

External POC / Exploit Code