The flaw allows unauthenticated attackers to upload malicious PHP files, which can then be executed to establish persistent remote access. Once the backdoor is in place, an attacker can run arbitrary code, steal data, or pivot further into the hosting environment. Because the plugin is a premium, third-party product, it is not covered by WordPress core security updates and site owners must obtain a fix directly from the vendor.

Reported details include:

• The vulnerability is rated critical and is being exploited in the wild.
• The attack vector is an unauthenticated file upload leading to remote code execution via a PHP backdoor.
• Site owners running the WooCommerce Wholesale Lead Capture plugin should check for available updates from the vendor and apply them immediately.
• Investigators recommend reviewing upload directories and server files for unexpected PHP files, and rotating credentials if a compromise is suspected.
• No specific CVE identifier was provided in the source report, so no CVE number is cited here.

If you run this plugin, treat any unexplained PHP files as suspicious, audit your logs for unexpected POST requests to plugin endpoints, and consider temporarily disabling the plugin until it can be patched. Keeping a clean backup and monitoring for outbound connections from your web server are also sensible precautions.

Source: BleepingComputer

Has your organization deployed this plugin, and if so, have you already applied the vendor's fix?