Source: bleepingcomputer.com
Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress. The attack allows threat actors to upload a PHP backdoor to compromised WordPress sites. The plugin, designed for WooCommerce-based stores, contains a flaw being leveraged in the wild. This represents an active exploitation campaign targeting WordPress e-commerce installations. Site administrators using the affected plugin are at immediate risk of full site compromise. The backdoor upload capability could grant attackers persistent remote access and control over affected sites. WordPress and WooCommerce site owners are urged to patch or remove the vulnerable plugin immediately.
