According to Wordfence, the flaw allows unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution. This makes it a serious risk for any site running the affected plugin, as a successful exploit can hand full control of the server to the attacker.

Key facts:

• The plugin affected is WooCommerce Wholesale Lead Capture.
• The vulnerability permits unauthenticated arbitrary file uploads, leading to PHP web shell deployment and remote code execution.
• Wordfence reports that it has blocked over a number of exploit attempts, though the article text is truncated at that point.

If your organization runs this plugin, treat it as urgent: verify whether it is installed and updated, and check for signs of compromise such as unexpected PHP files in upload directories. Given the active exploitation, patching or disabling the plugin until a fix is confirmed is the safest immediate step.

Source: The Hacker News

Is your organization running WooCommerce Wholesale Lead Capture, and if so, have you already patched or removed it?