Hackers Exploit WooCommerce Wholesale Lead Capture Plugin to Plant PHP Backdoors

Security researchers have verified that threat actors are actively abusing a critical flaw in the WooCommerce Wholesale Lead Capture premium plugin for WordPress, enabling them to upload a malicious PHP backdoor onto vulnerable sites.

The vulnerability lies in the plugin’s lead‑capture routine, which fails to properly validate file uploads. By sending crafted requests, attackers can place a backdoor script on the server without authentication, granting them the ability to execute arbitrary commands and maintain persistent access.

WordPress powers roughly 40% of all websites, and its extensibility through plugins makes it a frequent target for exploitation. WooCommerce, the platform’s leading e‑commerce extension, hosts thousands of add‑ons, including the Wholesale Lead Capture tool used by retailers to collect information from bulk‑buyer prospects. Because the plugin is sold as a premium product, many site owners assume it receives timely security patches, which can mask the risk.

When the backdoor is installed, attackers can pivot to steal credentials, modify site content, or launch further attacks against visitors. The breach can also facilitate the distribution of ransomware or defacement campaigns, amplifying the impact beyond the initial compromise. Security analysts warn that the presence of a backdoor is difficult to detect without thorough file‑system scans, as the malicious code can be disguised as a legitimate component of the plugin.

Plugin developers have responded by releasing an emergency update that addresses the file‑validation weakness. They are urging all users of the Wholesale Lead Capture extension to apply the patch immediately and to review server logs for any suspicious upload activity. In parallel, WordPress security experts recommend hardening site configurations, such as disabling direct PHP execution in upload directories and employing web‑application firewalls.

The incident underscores the broader challenge of maintaining the security of third‑party extensions in the WordPress ecosystem. As the platform continues to dominate the web‑publishing market, both developers and site owners must adopt proactive measures—regular updates, vulnerability monitoring, and rigorous testing—to mitigate the risk of similar exploits in the future.