Attackers are actively exploiting a critical vulnerability in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with more than 6,000 active installs. The flaw allows unauthenticated attackers to upload arbitrary files, making it possible to plant PHP web shells on affected websites.
A web shell gives an attacker persistent remote access to the compromised server, often serving as a foothold for further attacks. The discovery underscores the risk of third-party plugins, even those with a relatively small user base, when a critical flaw goes unpatched.
Because the source report provides only these details, there is no independent confirmation of the scope or identity of the attackers. But the active exploitation makes immediate patching important for anyone running the plugin.