Woocommerce Wholesale Lead Capture CVE-2026-27542

Remote unauthenticated attacker can exploit Rymera Web Co Woocommerce Wholesale Lead Capture plugin versions up to 2.0.3.1 installed on WordPress. No victim interaction required. Requires plugin to be active on target WordPress installation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates this is exploitable remotely over a network with low attack complexity, requires no privileges, and needs no user interaction, resulting in high impact to confidentiality, integrity, and availability. This combination makes it highly dangerous and likely automatable. The vulnerability allows complete privilege escalation from an unauthenticated state, potentially granting attackers full administrative control over WordPress installations. While EPSS scores and KEV status are not provided in the available intelligence, the technical characteristics (network-accessible, no authentication required, low complexity) suggest this vulnerability would be attractive to attackers and could be easily automated for mass exploitation. Sites running this plugin should treat this as a critical priority requiring immediate remediation, as the barrier to exploitation is extremely low and the potential impact is complete system compromise.

An unauthenticated remote attacker discovers a WordPress site running the vulnerable WooCommerce Wholesale Lead Capture plugin and directly accesses an unprotected administrative function endpoint through HTTP requests. By exploiting the incorrect privilege assignment, the attacker creates a new administrator account or elevates an existing low-privilege account to administrator status without any authentication. With administrative access achieved, the attacker can install malicious plugins, modify site content, steal customer data including payment information, deploy webshells for persistent access, or completely compromise the WordPress installation and potentially the underlying web server.