Critical Flaw in WooCommerce Wholesale Lead Capture Lets Attackers Plant PHP Backdoors

A team of security analysts has uncovered a high‑risk weakness in the WooCommerce Wholesale Lead Capture extension—a paid WordPress add‑on that supports wholesale ordering for over 6,000 active websites. The defect permits any remote user to transfer arbitrary files to the affected server, even PHP scripts that function as remote backdoors.

The problem originates from weak file‑validation on the plugin’s lead‑capture submission form. Since the upload endpoint lacks both authentication and rigorous file‑type verification, a malicious actor can forge a request that drops a harmful PHP file into a publicly reachable folder. With the file installed, the code can run any commands, granting the attacker complete control over the hijacked WordPress site.

Approximately 40 % of all sites run on WordPress, and while its plugin library provides powerful capabilities, it also enlarges the attack surface. Security specialists point out that even paid plugins—typically subjected to stricter quality checks than free ones—can suffer from coding mistakes. The WooCommerce Wholesale Lead Capture add‑on is popular among e‑commerce merchants who need to separate B2B buyers, so this vulnerability is especially worrisome for companies processing confidential order information.

The developer acted quickly, issuing an emergency update that strengthens file‑type checks and mandates authentication before any upload proceeds. Site owners are advised to install the patch without delay and to scan their installations for stray files that might have been dropped prior to the fix. Recommended security measures also include turning off file uploads on live sites unless they are essential and deploying a web‑application firewall to filter out malicious payloads.

Analysts note that the episode highlights why continuous plugin upkeep and vigilant monitoring of vulnerability advisories are crucial. Although a security aggregator initially reported the defect, the open disclosure triggered a swift remediation process, demonstrating how coordinated disclosure can shrink the exploitation window. With WordPress maintaining its lead in the content‑management arena, developers and site operators alike must remain alert to guard the platform against comparable supply‑chain attacks.