Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution," Wordfence said. The WordPress security company said it has blocked over

Report facts: The article describes active exploitation of a critical vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin, allowing unauthenticated attackers to upload arbitrary files such as PHP web shells and achieve remote code execution on affected sites. This impacts over 6,000 active installs and is being observed and blocked by WordPress security vendor Wordfence. RealGround analysis: While the incident is not directly about AI, it highlights supply-chain risk from third‑party plugins and web components that often host or integrate AI-powered features and agents. Organizations should treat CMS plugins and other upstream software in their AI stack as part of their AI supply chain, maintain an SBOM, and enforce patching and hardening so that web‑layer RCE cannot be used to pivot into AI infrastructure or exfiltrate AI-related data and models.