A critical, unpatched vulnerability in a WooCommerce plugin is being actively exploited, allowing attackers to seize control of online stores, security researchers have warned.
The flaw exists in the premium "WooCommerce Wholesale Lead Capture" WordPress plugin. It enables unauthenticated attackers to upload arbitrary files, including PHP web shells, and execute code directly on the server. The original report cites the plugin as having over 6,000 active installations, placing a significant number of e-commerce backends at risk.
Security firm Wordfence, which disclosed the vulnerability, reported blocking more than 12,000 exploitation attempts, confirming a widespread and ongoing attack campaign. As of publication, the plugin vendor has not released an official patch, leaving all installations exposed.
How the Attack Works: No Credentials Needed
The vulnerability enables a direct remote code execution (RCE) attack. Attackers require no prior access or user interaction—a simple crafted request is enough to compromise a vulnerable site.
"This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution," Wordfence stated in its advisory.
The ongoing attacks aim to establish persistent backdoor access, potentially leading to data theft, financial fraud, or the site being conscripted into malicious botnets.
Immediate Mitigation for Site Operators
Security experts are unequivocal: the only definitive protection is to disable or uninstall the WooCommerce Wholesale Lead Capture plugin immediately.
For businesses where the plugin is operationally critical, these interim steps are recommended: 1. Implement a WAF Rule: Configure a Web Application Firewall to block requests targeting the vulnerable file upload endpoint. 2. Conduct a Security Audit: Perform a full server scan for indicators of compromise, such as unknown PHP files, unauthorised admin accounts, or suspicious outbound connections. 3. Monitor for an Update: Closely track the vendor's communications and apply the security patch the moment it is released.
This incident underscores that a website's security is only as strong as its weakest third-party component. Proactive plugin management is not optional—it is a core security function.
A Systemic Risk for Online Businesses
The vulnerability highlights a persistent structural challenge within the WordPress ecosystem, where the security of countless sites depends on independent plugin developers. The gap between the discovery of a critical flaw and the availability of a fix creates a dangerous window that attackers are actively exploiting.
For small and medium-sized enterprises (SMEs), including those in Hong Kong, the situation is particularly acute. Disabling a key plugin may disrupt sales and daily operations, but failing to act risks severe data breaches and financial loss. Regular plugin audits, prompt attention to security alerts, and a tested incident response plan are essential components of running an online business. Treating these measures as optional is a significant security risk.
安全研究人員警告，一個WooCommerce插件中存在嚴重的未修補漏洞，正遭活躍利用，容許攻擊者奪取網上商店的控制權。
該漏洞存在於高級版「WooCommerce Wholesale Lead Capture」WordPress插件中。它容許未經認證的攻擊者上傳任意檔案，包括PHP web shell，並直接在伺服器上執行代碼。原始報告引述該插件有超過六千個活躍安裝，令大量電子商務系統後端面臨風險。
披露漏洞的安全公司Wordfence報告已攔截超過一萬二千次利用嘗試，證實這是一場大規模且持續的攻擊行動。截至發稿時，插件供應商尚未發布官方補丁，令所有安裝暴露於風險中。
攻擊運作方式：無需認證憑證
此漏洞容許直接的遠端代碼執行（RCE）攻擊。攻擊者無需事先取得存取權限或用戶互動——一個簡單的構造請求已足以入侵有漏洞的網站。
Wordfence在通告中表示：「此漏洞可被未經認證的攻擊者利用，以上傳任意檔案（包括PHP後門），並實現遠端代碼執行。」
持續進行的攻擊旨在建立持久的後門存取權限，可能導致數據竊取、金融詐騙，或將網站強行納入惡意殭屍網絡。
網站營運者的立即緩解措施
安全專家明確指出：唯一可靠的保護措施是立即停用或解除安裝WooCommerce Wholesale Lead Capture插件。
若企業因業務運營必須使用此插件，建議採取以下臨時措施： 1. 實施WAF規則： 設置網絡應用程式防火牆，以阻止針對有漏洞的檔案上傳端點的請求。 2. 進行安全審計： 對伺服器進行全面掃描，檢查入侵指標（IOC），例如未知的PHP檔案、未經授權的管理員帳戶或可疑的出站連線。 3. 密切關注更新： 密切追蹤供應商的通訊，並在安全補丁發布後立即套用。
此事件突顯網站的安全性僅與其最薄弱的第三方組件一樣強。主動管理插件並非可選項——而是一項核心安全職能。
網上企業的系統性風險
此漏洞揭示了WordPress生態系統中一個持續存在的結構性挑戰：無數網站的安全性取決於獨立的插件開發者。從發現嚴重漏洞到修補方案可用之間的時間差，創造了一個攻擊者正積極利用的危險窗口期。
對於包括香港在內的中小企而言，情況尤為嚴峻。停用關鍵插件可能中斷銷售和日常運營，但不行動則面臨嚴重的數據洩露和財務損失風險。定期審計插件、即時關注安全警報及制定經測試的應變計劃，是經營網上業務的必要組成部分。將這些措施視為可選項，是重大的安全風險。