Overview
- Security researcher Teemu Saarentaus and CVE records tied the bug to CVE-2026-27540 and the plugin was patched in version 2.0.3.2 on February 20, 2026.
- Defiant’s Wordfence telemetry has blocked more than 100,000 exploit attempts, which saw concentrated spikes between June 4 and June 17 and additional activity on July 1 and August 30.
- The flaw exposes an unauthenticated AJAX action named wwlc_file_upload_handler that trusts a user-supplied file_settings allowlist and lets attackers add the php extension to upload executable files.
- Attackers have been uploading a PHP webshell (commonly shell.php) that reports host details and provides a browser upload interface for dropping more malicious files, making removal and cleanup difficult.
- Site owners should update to v2.0.3.2 or later, scan upload directories for unexpected .php files, review admin-ajax.php logs for the wwlc_file_upload_handler action, block high-offender IPs published by Wordfence, and restore from trusted backups if compromise is confirmed.