WORDPRESS SITES HIT BY WOOCOMMERCE PLUGIN EXPLOIT

Security researchers have detected active exploitation of a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin. The flaw enables attackers to upload malicious PHP files directly to compromised WordPress installations, establishing persistent backdoor access. The vulnerability affects the premium plugin, which is designed to capture and manage wholesale customer leads in WooCommerce stores. Attackers are leveraging the flaw to inject code that grants them ongoing control over target sites. WordPress site administrators using the WooCommerce Wholesale Lead Capture plugin should immediately update to the patched version. Users should also audit their sites for unauthorized PHP files and suspicious activity in their upload directories. This incident underscores the security risks associated with third-party WordPress plugins. Site operators are advised to keep all plugins updated, remove unused plugins, and use security plugins to monitor for unauthorized file uploads.