Researchers have flagged two sets of WordPress plugin flaws that attackers can reach without logging in. One is already being exploited at volume.
Wordfence says it has blocked more than 100,000 exploit attempts since June against WooCommerce Wholesale Lead Capture, a premium plugin with over 6,000 installs. The bug, CVE-2026-27540, scores 9.8. Missing file type validation in an AJAX action called wwlc_file_upload_handler lets an unauthenticated attacker upload arbitrary files, including PHP.
A web shell that offers an upload form
In observed attacks, intruders send a crafted request carrying a forged file_settings parameter and a PHP payload named shell.php. The uploaded file reports host details and serves a browser form for writing further malicious files. Wordfence published ten source IP addresses to hunt for in logs, mostly in admin-ajax.php calls using that action.
The second pair of bugs sits in The Events Calendar, installed on more than 600,000 sites. Defiant tracked them as CVE-2026-78159 and CVE-2026-78006, both rated 9.8. The first is an unauthenticated code injection triggered through single-event HTML. The second is a PHP object injection issue that works when comments are enabled and visible on events. Both chains end in remote code execution.
StellarWP fixed the first in version 6.17.3.1 on August 25 and the second in 6.17.4.1 on September 10. WordPress data suggests roughly 240,000 sites still run versions older than 6.17.
Site owners should patch, then check uploads directories for unexpected PHP files.
