Critical WooCommerce plugin vulnerability under active exploitation

Infosecurity Magazine reports that attackers are actively exploiting a critical vulnerability in a third-party WooCommerce plugin to upload PHP webshells to vulnerable WordPress sites. The flaw affects the WooCommerce Wholesale Lead Capture plugin and allows unauthenticated attackers to upload malicious files that can then be used to execute arbitrary code on the server. WooCommerce is one of the most widely used e-commerce platforms globally, powering millions of online stores, and third-party plugins are a common way for site owners to extend functionality. However, the security of these plugins varies significantly, and vulnerabilities in popular extensions can create widespread risk. Once a webshell is successfully uploaded, attackers can use it to maintain persistent access, steal data, modify site content, or launch further attacks against customers or other systems.

Why this matters for UK organisations

For UK businesses running WordPress and WooCommerce sites, this is a reminder that third-party plugins represent a significant and often underestimated attack surface. Many organisations focus security attention on the core WordPress platform and overlook the fact that plugins, particularly those from smaller or less well-known developers, may not be subject to the same level of security scrutiny. The fact that this vulnerability is being actively exploited means that attackers are already scanning for vulnerable sites and attempting to compromise them. Organisations should review their WordPress and WooCommerce deployments, identify which plugins are installed, ensure that all plugins are up to date, and consider whether less critical or rarely used plugins should be removed entirely. This is also an opportunity to ensure that responsibility for maintaining and monitoring WordPress sites is clearly assigned and that patching processes are consistently followed. For e-commerce businesses, the risk extends beyond the website itself to include customer data, payment information, and business reputation.

What to review

Organisations running WordPress and WooCommerce sites should identify all third-party plugins installed across their web estate and ensure they are all up to date. Security teams should prioritise identifying and patching any sites using the WooCommerce Wholesale Lead Capture plugin and should review server logs for any signs of suspicious file uploads or webshell activity. This is a prompt to review whether less critical or rarely used plugins should be removed entirely and whether plugin management processes are clearly defined and consistently followed. Organisations should also ensure that responsibility for maintaining and securing WordPress sites is clearly assigned and that patching, monitoring, and review processes are in place. For e-commerce businesses, this is an opportunity to review whether appropriate security controls are in place to protect customer data and payment information and whether incident response plans adequately address the risk of website compromise.

Source: Infosecurity Magazine