WooCommerce store hacked through a plugin: Guide to detect webshells before they steal customer data

WooCommerce stores running the Wholesale Lead Capture plugin can be hacked through CVE-2026-27540, an unauthenticated file upload flaw that lets attackers plant a PHP webshell with no login, no error, and no visible change to the storefront. The fix is to update to version 2.0.3.2 or later, check your uploads directory and admin user list for signs of compromise, and rotate every credential if you find one.

If your WooCommerce store runs the Wholesale Lead Capture plugin version 2.0.3.1 or earlier, attackers may have already uploaded a PHP webshell to your server. An unauthenticated file upload vulnerability allows anyone to plant a backdoor without logging in, and the attack leaves no admin notification, no error, and no visible storefront change. Check for unknown PHP files in your uploads directory immediately.

Signs your WooCommerce store may already be compromised

The danger of a webshell compromise is what you don’t see. The store keeps functioning. Orders keep processing. The WordPress admin looks normal. But underneath, attackers have persistent server access that lets them:

• Inject checkout skimmers that capture payment card data during legitimate transactions
• Exfiltrate customer databases including names, emails, addresses, and order histories
• Modify core files to maintain access even after the original vulnerability is patched
• Redirect a percentage of traffic to phishing or malware pages, often only for certain geographies or devices, making the redirect invisible to the merchant

You might eventually notice indirect symptoms:

• Google Search Console warnings about malware or phishing on your domain
• Customer complaints about unexpected redirects or browser security warnings
• Email deliverability drops as your domain gets blacklisted
• Unexplained new admin users or changed file modification timestamps
• Your hosting provider suspending your account after a security scan

Likely error messages or warnings:

• “Deceptive site ahead” (Google Chrome Safe Browsing)
• “This site may harm your computer” (Google Search results)
• “Malware detected” (hosting provider notification)
• “Account suspended due to malicious activity” (host email)

What is CVE-2026-27540 and why it matters now

The Wholesale Lead Capture Plugin for WooCommerce, developed by Rymera Web Co, had a critical flaw: the file upload functionality used during wholesale application registration did not validate file types. An attacker could submit a PHP file disguised as a document, and WordPress would save it to a publicly accessible location on the server.

No authentication required. No CAPTCHA. No admin approval.

The vulnerability is tracked as CVE-2026-27540, and Wordfence has blocked over 100,000 exploitation attempts against it across two distinct attack waves: one between June 4–17, 2026, and a larger one between July 1 and August 30, 2026. The Hacker News and BleepingComputer brought wider attention to the campaign in mid-September 2026, which is why it’s trending now even though the underlying flaw is older.

The vulnerability was actually patched back on February 20, 2026, in version 2.0.3.2. That means any store still running 2.0.3.1 or earlier has been exposed for roughly seven months, well past both attack waves. If your site was online and unpatched at any point between February and now, treat it as potentially compromised regardless of when you eventually update.

This exploitation follows a broader pattern in the WordPress ecosystem: plugins are consistently the largest source of new vulnerabilities, and a meaningful share of disclosed flaws have no patch available from the developer at the moment they become public. Treating “not yet disclosed” as “not yet a risk” is a mistake that leaves stores exposed long before anyone notices.

How to check if your WooCommerce store is already compromised

Work through these steps in order, starting with the most immediate checks:

Step 1: Check the uploads directory for unknown PHP files

Connect via SFTP or SSH and run:

find wp-content/uploads/ -name "*.php" -type f

Legitimate WordPress uploads are images, documents, and media files. Any PHP file in your uploads directory is suspicious. Common webshell filenames include random strings, names mimicking WordPress files (e.g., wp-cache.php, class-wp.php), or simple names like shell.php or x.php.

Step 2: Check for recently modified core files

find wp-includes/ wp-admin/ -name "*.php" -newer wp-includes/version.php -type f

Any WordPress core file modified after your last update is a strong indicator of tampering.

Step 3: Review WordPress user accounts

In your WordPress admin, go to Users → All Users and filter by Administrator role. Look for accounts you did not create. Attackers commonly add a new admin account to maintain access after the webshell is discovered.

Step 4: Check for persistence mechanisms

Review wp-config.php for unexpected define statements or require calls that load external files. Check server cron jobs:

crontab -l

Also search for base64-encoded payloads, a hallmark of obfuscated webshells:

grep -r "base64_decode\|eval(" wp-content/plugins/ wp-content/themes/

Step 5: Scan with a file integrity checker

Use Wordfence, Sucuri SiteCheck, or your hosting provider’s malware scanner to compare current files against known clean versions.

Step 6: Review access to customer and order data

Check your server access logs for unusual requests to customer or order API endpoints. An attacker with shell access can query the WooCommerce database directly.

Step 7: Check access logs for the exact exploit signature

This vulnerability is exploited through one specific AJAX action. Search your web server or hosting access logs for it directly:

grep "wwlc_file_upload_handler" /path/to/access.log

A hit doesn’t automatically mean a successful compromise; many of these requests get blocked by a firewall before they succeed, but it does confirm your site was targeted, which should raise the priority of every other step on this list.

Immediate containment steps

If you find evidence of compromise:

1. Do not simply delete the webshell and move on. Attackers typically create multiple persistence mechanisms. One visible webshell often hides two or three more.
2. Take the site offline temporarily if possible. Use a maintenance page to prevent further data exposure.
3. Change all credentials, WordPress admin passwords, database passwords, SFTP/SSH keys, WooCommerce API keys, and payment gateway API keys.
4. Update the Wholesale Lead Capture plugin to version 2.0.3.2 or later, or remove it entirely if you do not actively use it.
5. Update WordPress to WordPress 7.1.1 (released September 17, 2026, with 11 security fixes) and WooCommerce to WooCommerce 11.1.1 (released September 18, 2026, as a further security release). Neither update patches CVE-2026-27540 itself, but both close off unrelated attack surface an intruder could use once inside your server.
6. Restore from a known-clean backup taken before the exploitation window, then re-apply all patches.
7. Notify affected customers as required by your jurisdiction’s data breach notification laws. GDPR requires notification within 72 hours of becoming aware of a personal data breach.

Verification: How to confirm your store is clean

After remediation, verify recovery:

• Run a full malware scan with at least two independent tools (e.g., Wordfence + Sucuri SiteCheck)
• Check Google Search Console for security issues and submit a review request if warnings were applied
• Test checkout end-to-end from a clean browser and device to verify no skimmer was injected
• Monitor server access logs for 7–14 days for signs of re-exploitation
• Verify no unauthorised redirects by testing your store from multiple geographies and devices
• Confirm payment gateway integrity: check that your payment processor credentials and webhook endpoints have not been changed

Prevention and continuous monitoring

Patching alone is not enough when a fix can sit unused for seven months before mass exploitation catches up with it:

• Audit every installed plugin. Remove any you do not actively use. Each one is an independent attack surface.
• Enable automatic security updates for plugins where your hosting environment supports it.
• Implement file integrity monitoring that alerts you when PHP files are added or modified outside of your deployment process.
• Restrict file upload directories with .htaccess rules that prevent PHP execution in wp-content/uploads/.
• Monitor your storefront continuously for the customer-facing symptoms of compromise: unexpected redirects, injected scripts, modified checkout pages, and new external resource loads.

Patching the plugin and cleaning out a webshell closes the door attackers used to get in, but it doesn’t tell you if they’re still inside through a different route, or if a similar plugin vulnerability opens up next month. Detecting a compromise like this one depends on watching for the handful of customer-facing and server-side signals that give it away, continuously, not during an occasional manual audit.

AuditIQ covers exactly this ground across four dedicated capabilities:

• Malware Detection, scans your store’s frontend code and server files continuously for webshells, obfuscated scripts, and known malware signatures, flagging the type, location, and severity the moment something appears.
• File Integrity Monitoring, logs every file modification, creation, or deletion on your server in real time, so a webshell dropped into wp-content/uploads or a tampered core file is caught immediately instead of during a forensic review weeks later.
• CSP Monitoring, logs every Content Security Policy violation on your storefront, catching unauthorised scripts and Magecart-style skimming attempts injected into checkout pages before they exfiltrate payment data.
• Script Inventory, maintains a running ledger of every script executing on your store, so a new, unexpected script, the kind attackers add for redirects or skimming, is flagged the moment it first appears.

Beyond security, AuditIQ is a 360° eCommerce monitoring platform purpose-built for Magento, Adobe Commerce, Shopify and WooCommerce stores. It continuously monitors every critical layer of a store, performance, infrastructure, SEO, security, user experience, configuration, and code quality, from a single, unified dashboard, so a compromise like CVE-2026-27540 is caught through the customer-facing symptoms it produces, not months later through a chargeback report or a Google Safe Browsing warning.

Start monitoring your WooCommerce store for free today to catch the next webshell before it reaches your customers' payment data.

Others also read

• 40,000 WooCommerce checkouts compromised: Why real-time store monitoring is no longer optional
• The WebRTC Skimmer Threat: Why real-time eCommerce monitoring is no longer optional
• Payment plugin gets patched, your checkout doesn’t verify itself: The revenue gap between security updates and storefront integrity

FAQ

1. How do I know if my WooCommerce store has been hacked through a plugin?

Check your wp-content/uploads/ directory for PHP files, review admin user accounts for unknown additions, scan for recently modified core files, and run a malware scan with Wordfence or Sucuri.

2. Is CVE-2026-27540 still being actively exploited?

Yes, though the heaviest attack waves ran between June and August 2026, not September, September is when the campaign got wide press coverage. Wordfence has blocked over 100,000 exploitation attempts in total. Any store running Wholesale Lead Capture plugin version 2.0.3.1 or earlier is still at risk today.

3. Should I remove the Wholesale Lead Capture plugin entirely?

If you actively use it for wholesale customer registration, update to version 2.0.3.2 or later immediately. If you installed it but do not actively use it, remove it, every unused plugin is unnecessary attack surface.

4. What should I do if I find a webshell on my WooCommerce store?

Do not just delete it. Assume multiple persistence mechanisms exist. Change all credentials, restore from a pre-compromise backup, apply all patches, run a comprehensive malware scan, and monitor for re-exploitation for at least two weeks.

5. How can I prevent plugin-based attacks on WooCommerce?

Minimise installed plugins, enable automatic security updates, block PHP execution in upload directories, implement file integrity monitoring, and use continuous storefront monitoring to detect customer-facing compromise symptoms before attackers can exfiltrate data.