{"id":"CVE-2026-27540","title":"WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability","summary":"Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.","severity":"critical","cvss":9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-434"],"vendor":"Rymera Web Co Pty Ltd.","product":"woocommerce-wholesale-lead-capture","affected":["woocommerce-wholesale-lead-capture <= 2.0.3.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-03-19T13:46:25.876487Z"},"exploitAvailable":true,"published":"2026-03-19","updated":"2026-11-05","sourceUpdated":"2026-11-05T11:03:01.874Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-27540","references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"}],"tags":["cve.org","exploit-available"],"epss":0.02688,"epssPercentile":0.85907,"exploits":{"github":1,"githubRepos":["https://github.com/winrarzipsexploit/CVE-2026-27540"],"checkedAt":"2026-11-05T21:36:37.229Z"},"ingestedAt":"2026-11-05T21:36:00.800Z","slug":"CVE-2026-27540","body":"## Overview\n\nUnrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.\n\n## Affected\n\n- `woocommerce-wholesale-lead-capture <= 2.0.3.1`\n\n## Remediation\n\nUpdate to 2.0.3.2 or a higher version.","depth":"abyssal","depthScore":62,"depthScoreParts":{"impact":49.5,"likelihood":0.5,"exploitation":12,"ransomware":0},"changes":[]}