WooCommerce Wholesale Lead Capture Plugin Used by Hackers to Insert PHP Backdoors

Researchers in security have confirmed that attackers are exploiting a serious vulnerability in the premium WooCommerce Wholesale Lead Capture plugin for WordPress, allowing them to upload a malicious PHP backdoor to compromised sites.

The flaw resides in the plugin’s lead‑capture function, which does not correctly validate uploaded files. Crafted requests let attackers drop a backdoor script onto the server without needing to authenticate, giving them the power to run arbitrary commands and retain persistent access.

Approximately 40% of all websites run on WordPress, and the platform’s plugin‑based extensibility turns it into a common exploitation target. WooCommerce, the top e‑commerce add‑on for WordPress, offers thousands of extensions, among them the Wholesale Lead Capture tool that merchants use to gather data from bulk‑buyer leads. As the plugin is marketed as a premium offering, many owners trust that it receives prompt security updates, which can conceal the underlying danger.

Once the backdoor is in place, threat actors can move laterally to exfiltrate credentials, alter site content, or initiate additional attacks on visitors. The compromise may also enable ransomware distribution or site defacement, magnifying the damage beyond the original breach. Analysts caution that detecting such a backdoor is challenging without comprehensive file‑system scans, since the malicious script can masquerade as a legitimate plugin component.

The plugin’s developers have issued an emergency update that fixes the file‑validation issue. They advise every Wholesale Lead Capture user to install the patch without delay and to audit server logs for any anomalous upload events. Simultaneously, WordPress security specialists suggest tightening site settings, for example by disabling direct PHP execution in upload folders and using web‑application firewalls.

This episode highlights the wider difficulty of keeping third‑party extensions secure within the WordPress ecosystem. As the platform maintains its dominance in web publishing, developers and site owners alike need to employ proactive strategies—prompt updates, continuous vulnerability monitoring, and thorough testing—to reduce the likelihood of comparable exploits going forward.