RiskWire Real-time vulnerability intelligence

This week Pricing Live dashboard

Critical 9.8

CVE-2026-27540

Active Exploitation of Critical CVE-2026-27540 Flaw in WooCommerce Wholesale Lead Capture Plugin

Vendor / product: WooCommerce Wholesale Lead Capture

Event date: 2026-06-04

Public PoC: Yes

First tracked by RiskWire: 2026-09-16

Sources & citations (3)

WooCommerce Plugin Flaw Under Attack: Hackers Launch 100,000+ Exploit Attempts esecurityplanet.com · 2026-09-16
Third-party WooCommerce plugin hits WordPress sites with PHP backdoor abusing recently patched vulnerability tech.yahoo.com · 2026-09-16
PHP Webshell Campaign Targets WordPress Through Critical WooCommerce P infosecurity-magazine.com · 2026-09-16

References

View on NVD ↗ View on MITRE CVE ↗ Search CISA ↗ KEV lookup tool

See CVE-2026-27540 in context

RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.

Book a 20-min demo →