What is the CVSS score of CVE-2026-27540?

CVE-2026-27540 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-27540?

A critical vulnerability in the WooCommerce Wholesale Lead Capture plugin allows unauthenticated attackers to upload and execute malicious code on affected WordPress sites, potentially leading to…

How to fix or mitigate CVE-2026-27540?

Within 24 hours: Identify all WordPress instances using the vulnerable plugin and disable or remove it immediately; isolate affected systems from critical business processes if removal is not immediately feasible. Within 7 days: Conduct forensic analysis of affected systems for signs of compromise, reset all administrative credentials, and review access logs for unauthorized activity. Within 30 days: Establish a plugin governance process requiring security vetting before deployment, implement a Web Application Firewall with file upload restrictions, and migrate to alternative solutions that meet security requirements.

WordPress CVE-2026-27540

EUVD-2026-13059 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-19 Patchstack

File Upload WordPress

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 19, 2026 - 06:00 euvd

EUVD-2026-13059

Analysis Generated

Mar 19, 2026 - 06:00 vuln.today

CVE Published

Mar 19, 2026 - 05:24 nvd

CRITICAL 9.0

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through 2.0.3.1.

AnalysisAI

An unrestricted file upload vulnerability exists in the Woocommerce Wholesale Lead Capture plugin for WordPress, allowing remote attackers to upload and execute malicious files without authentication. The vulnerability affects all versions through 2.0.3.1 of the plugin developed by Rymera Web Co Pty Ltd. With a CVSS score of 9.0 (Critical), this vulnerability enables attackers to achieve complete system compromise through arbitrary file upload, though the attack complexity is rated as high.

Technical ContextAI

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), affecting the WordPress plugin identified by CPE cpe:2.3:a:rymera_web_co_pty_ltd.:woocommerce_wholesale_lead_capture. The Woocommerce Wholesale Lead Capture plugin is designed to capture and manage wholesale customer leads for WooCommerce stores. The vulnerability stems from inadequate validation of uploaded files, failing to properly restrict file types, extensions, or content before storing them on the server. This allows attackers to bypass intended security controls and upload executable files such as PHP scripts, which can then be accessed directly via web requests to gain code execution on the vulnerable WordPress installation.

RemediationAI

Immediately upgrade Woocommerce Wholesale Lead Capture to a version newer than 2.0.3.1 if available from the vendor Rymera Web Co Pty Ltd through the official WordPress plugin repository or vendor website. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve for specific patch information and version recommendations. If immediate patching is not feasible, consider temporarily disabling the plugin until an update can be applied, particularly if the lead capture functionality is not business-critical. Implement web application firewall (WAF) rules to restrict file uploads to known safe extensions and enforce strict content-type validation. Review server logs for suspicious file upload attempts to endpoints associated with this plugin, and scan the WordPress uploads directory for recently added PHP, executable, or otherwise unexpected file types that may indicate prior exploitation.