WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation

Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture = 2.0.3.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions. id: CVE-2026-27542 info: name: WooCommerce Wholesale Le...

CVE-2026-27541-Analysis-Lab

CVE-2026-27541 — WooCommerce Wholesale Prices 인증된 권한 상승 실습 환경 개요 이 프로젝트는 WooCommerce Wholesale Prices / Wholesale Suite 플러그인의 CVE-2026-27541 동작을 분석하고 재현하기 위한 로컬 Docker 실습 환경으로, 동일한 머신에서 취약한 빌드와 패치된 빌드를 나란히 비교합니다. 핵심 문제는 다음 REST API 엔드포인트의 깨진 접근 제어Broken Access Control 입니다:...

CVE-2026-27542-CVE-2026-27540-

🔴 취약점 개요 CVE-2026-27542 — 인증되지 않은 권한 상승 필드| 세부 정보 ---|--- CVE ID| CVE-2026-27542 심각도| 치명적 — CVSS v3.1 점수: 9.8 벡터| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 영향받는 구성 요소| WordPress용 WooCommerce Wholesale Lead CaptureWWLC 플러그인 취약점 유형| 인증되지 않은 권한 상승 인증 필요| 없음 CWE| CWE-269: 잘못된 권한 관리 설명: WordPress용...

CVE-2026-27540

🌐 Language / Dil 📌 요약 WooCommerce Wholesale Lead Capture WWLC — 인증되지 않은 파일 업로드 → RCE | ---|--- 제품| WooCommerce Wholesale Lead Capture — wwlc 플러그인 버전| ≤ 2.0.3.1 Fixed| 2.0.3.2+ — 업로드 핸들러 보호됨 Auth| Unauthenticated 벡터| admin-ajax.php?action=wwlcfileuploadhandler 필드| file multipart upload 기록 위치|...

Exploit for CVE-2026-27540

🌐 Language / Dil --- 📌 Özet Woo...

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remot...

CVE-2026-27540 WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through 2.0.3.1...

CVE-2026-27540

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through 2.0.3.1...

CVE-2026-27542

Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Privilege Escalation.This issue affects Woocommerce Wholesale Lead Capture: from n/a through 2.0.3.1...

CVE-2026-27542

CVE-2026-27542 and CVE-2026-27540 affect the WordPress WooCommerce Wholesale Lead Capture plugin up to version 2.0.3.1. CVE-2026-27542 is an unauthenticated privilege-escalation in wwlc_create_user that can inject arbitrary WordPress capabilities (including administrator) during registration, ena...

CVE-2026-27542: Incorrect Privilege Assignment

Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Privilege Escalation.This issue affects Woocommerce Wholesale Lead Capture: from n/a through = 2.0.3.1...

CVE-2026-27540: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through = 2.0.3.1...

CVE-2026-27541

Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through = 2.2.6...

EUVD-2026-9651

Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through = 2.2.6...

CVE-2026-27541

Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through = 2.2.6...

CVE-2026-27541

CVE-2026-27541 pertains to the WordPress plugin Wholesale Suite (woocommerce-wholesale-prices)

CVE-2026-27541

Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through = 2.2.6...

CVE-2026-27541: Incorrect Privilege Assignment

Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through = 2.2.6...

VulnCheck KEV: CVE-2026-27541

Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through = 2.2.6...

VulnCheck KEV: CVE-2026-27542

Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Privilege Escalation.This issue affects Woocommerce Wholesale Lead Capture: from n/a through = 2.0.3.1...