CRITICAL CWE-434
CVE-2026-27540
WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability
Rymera Web Co Pty·Woocommerce Wholesale Lead Capture
9.0/ 10
CVSS 3.1
Critical severity
2.7%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 86% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Mar 19, 2026
- Updated
- Nov 5, 2026
- First covered
- Sep 16, 2026
- Latest story
- 2 months ago
Summary
Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.
CWE-434Unrestricted Upload of File with Dangerous Type
Attack profile
Attack vectorNetwork
ComplexityHigh
PrivilegesNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HAffected products
- Rymera Web Co Pty Woocommerce Wholesale Lead Captureup to 2.0.3.1