Woocommerce Wholesale Lead Capture EUVD-2026-13059

Requires WooCommerce Wholesale Lead Capture plugin version 2.0.3.1 or earlier installed on WordPress site. Attacker uploads malicious file through plugin's upload functionality. AC:H suggests specific file type or configuration bypass needed; exact conditions unclear from description.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates a critical vulnerability exploitable over the network without authentication or user interaction, though with high attack complexity. The scope change (S:C) suggests the vulnerability can affect resources beyond the vulnerable component itself, potentially compromising the entire web server or other hosted applications. The high attack complexity likely reflects the need for specific conditions such as knowledge of upload endpoints or timing windows. Despite the 9.0 CVSS score, the practical risk depends heavily on whether the plugin is actively used in production environments and internet-accessible. The vulnerability was reported by Patchstack, a reputable WordPress security research firm, lending credibility to the finding. While no EPSS score or KEV status is provided, the combination of unauthenticated remote exploitation and potential for complete system compromise makes this a genuine priority for organizations running affected versions, particularly given the ease with which file upload vulnerabilities can be weaponized once the attack vector is understood.

An unauthenticated attacker identifies a WordPress site running the vulnerable Woocommerce Wholesale Lead Capture plugin by fingerprinting common plugin paths or forms. The attacker crafts a malicious request to the plugin's file upload functionality, bypassing client-side validation and uploading a PHP web shell disguised with a double extension or null byte injection technique. Once uploaded, the attacker directly accesses the malicious file through its web-accessible path, executing arbitrary PHP code with the privileges of the web server user, enabling full site compromise, database access, lateral movement to other hosted applications, or deployment of persistent backdoors and cryptocurrency miners.