{"vulnerability": "cve-2026-27540", "sightings": [{"uuid": "6e8b951c-0072-4ceb-acba-44c06619c881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mfumc26ug72k", "content": "", "creation_timestamp": "2026-02-27T21:03:02.286766Z"}, {"uuid": "e1dd93e6-91b6-4d08-a182-cefa7d4b8945", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhff6wxohx2k", "content": "", "creation_timestamp": "2026-03-19T06:36:29.738920Z"}, {"uuid": "a74027df-6e11-449f-9082-0d5cd6ced502", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhfg5kwp5q2c", "content": "", "creation_timestamp": "2026-03-19T06:53:37.559475Z"}, {"uuid": "1b3f94a6-30fa-4c45-8e15-6e22824a70a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-27540", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116254784076288405", "content": "", "creation_timestamp": "2026-03-19T08:00:28.593583Z"}, {"uuid": "0628cdc4-fefa-44a1-ae2e-4a517ddcd031", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mhfg5mbulb25", "content": "", "creation_timestamp": "2026-03-19T06:53:38.348782Z"}, {"uuid": "4f0ad206-6c24-4f8c-9608-d74daca6e482", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-27540", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mhfjv63bkv2n", "content": "", "creation_timestamp": "2026-03-19T08:00:31.131790Z"}, {"uuid": "2af666bc-4746-41d1-844c-c5c9dce14aa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhfg5tzwzb2x", "content": "", "creation_timestamp": "2026-03-19T06:53:46.950775Z"}, {"uuid": "9580aba2-635b-4c77-b4da-1814dfc836b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhfk7dabxd2o", "content": "", "creation_timestamp": "2026-03-19T08:06:10.885255Z"}, {"uuid": "b8c47627-0d87-49c9-b4c2-5294a723b824", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://t.me/GithubRedTeam/80794", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-27542-CVE-2026-27540-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Nxploited\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-18 08:56:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated Privilege | Unauthenticated Arbitrary File Upload\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-18T09:00:04.000000Z"}, {"uuid": "6a8086bb-3cf5-4b0d-8604-5e47a29736a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "published-proof-of-concept", "source": "Telegram/56SNjB68nyULYTdkaeIILQI4ytkQLoACBGmTDoXIf258Id4", "content": "", "creation_timestamp": "2026-04-18T11:00:12.000000Z"}, {"uuid": "32825964-e25c-41db-afb6-4fde4f3eefca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mvkkq7i2gn2z", "content": "WooCommerce bug CVE-2026-27540 enables PHP backdoor uploads without login \u2014 update to v2.0.3.2 NOW. #WooCommerce #CVE2026-27540 #WordPress #Cybersecurity #PluginVulnerability https://thedailytechfeed.com/critical-woocommerce-extension-bug-lets-hackers-take-over-sites-without-login/", "creation_timestamp": "2026-09-15T11:51:39.473856Z"}, {"uuid": "965905dc-77c1-45ff-ab76-3dbee5b90c7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mvklantaay25", "content": "Kritieke kwetsbaarheid in WooCommerce-extensie opent deuren voor hackers.\n\nEen ernstige beveiligingskwetsbaarheid, met de aanduiding CVE-2026-27540 en een CVSS-score van 9.8, is ontdekt in de WooCommerce-extensie Wholesale Lead Capture. Deze kwetsbaarheid treft versies tot en met 2.0....", "creation_timestamp": "2026-09-15T12:00:51.004828Z"}, {"uuid": "a4769345-4a4d-4a08-8e7a-21b4b210eb9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvkzhtet2k2x", "content": "Hackers are exploiting CVE-2026-27540 in WooCommerce Wholesale Lead Capture to upload PHP backdoors and take over WordPress sites. Wordfence blocked 100,000+ attempts. #WooCommerce #WordPress #Wordfence", "creation_timestamp": "2026-09-15T16:15:24.604191Z"}, {"uuid": "b5059ea8-356f-4e2c-ada0-9295018c06f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvl7y3sycb2u", "content": "\ud83e\udd16 CVE-2026-27540: unauthenticated file upload in the WooCommerce Wholesale Lead Capture plugin (\u22642.0.3.1) allows PHP webshell uploads on WordPress sites. Patched in 2.0.3.2; 100k+ attacks blocked in the\u2026", "creation_timestamp": "2026-09-15T18:11:52.703842Z"}, {"uuid": "ee9b1ed6-49bb-4c56-8367-93ecf36d991b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b7d21082-0789-4184-99b0-9c0abf4da6fb", "content": "", "creation_timestamp": "2026-09-15T19:00:44.250191Z"}, {"uuid": "1199f712-e278-4d2a-a166-6a666f25048f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mvmjj34ckn22", "content": "Threat actors are actively exploiting CVE-2026-27540, a critical arbitrary file upload flaw in the WooCommerce Wholesale Lead Capture plugin with [\u2026]", "creation_timestamp": "2026-09-16T06:35:05.780327Z"}, {"uuid": "1d33b201-3b47-4a61-8393-ca2eb982fbdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mvmjzot6fs23", "content": "Unauthenticated attackers exploit CVE-2026-27540 in WooCommerce Wholesale Lead Capture to upload arbitrary files, including PHP web shells, enabling remote code execution.\n", "creation_timestamp": "2026-09-16T06:44:23.251706Z"}, {"uuid": "c1ff7d0b-0b64-4e67-b3df-d88903dcb82c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/javascriptbriefly.bsky.social/post/3mvmk2hf47y2o", "content": "Unauthenticated attackers exploit CVE-2026-27540 in WooCommerce Wholesale Lead Capture to upload arbitrary files, including PHP web shells, enabling remote code execution.\n", "creation_timestamp": "2026-09-16T06:44:49.684232Z"}, {"uuid": "9a3202cc-f055-4fa0-9a77-633484025f80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvmk2rcrm62j", "content": "Unauthenticated attackers exploit CVE-2026-27540 in WooCommerce Wholesale Lead Capture to upload arbitrary files, including PHP web shells, enabling remote code execution.\n", "creation_timestamp": "2026-09-16T06:44:59.153067Z"}, {"uuid": "705c4b8b-db4d-45bf-aa9a-327f381a5847", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-27540", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mvmpv3rq4a2f", "content": "\ud83d\udcf0 Hacker Aktif Menargetkan Situs WordPress lewat Plugin WooCommerce\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/16/cve-2026-27540-woocommerce-wordpress/\n\n#cybersecurity #keamananSiber #keamananWordpress #malware #vulnerability #webshell #woocommerce #wordpress", "creation_timestamp": "2026-09-16T08:29:10.709624Z"}, {"uuid": "15f3e5c5-35c1-41f5-a7b1-b5fc6ef766c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://t.me/thehackernews/10067", "content": "\ud83d\udea8 Attackers are exploiting a critical WooCommerce Wholesale Lead Capture flaw to plant PHP web shells.\n\nWordfence has blocked over 100,000 exploit attempts since June against CVE-2026-27540, which affects versions through 2.0.3.1.\n\nRead: https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html", "creation_timestamp": "2026-09-16T09:00:03.983453Z"}, {"uuid": "98b2cf99-d2c3-40cb-85fb-1f7842d7a8df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://t.me/CyberDispatch/2963", "content": "Attackers are exploiting a critical WooCommerce Wholesale Lead Capture flaw to plant PHP web shells.\n\nWordfence has blocked over 100,000 exploit attempts since June against CVE-2026-27540, which affects versions through 2.0.3.1.", "creation_timestamp": "2026-09-16T10:00:05.315844Z"}, {"uuid": "cd2d08d8-df39-45ee-a81c-97cbbcf83b62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/alextech-ai.bsky.social/post/3mvn2htyq2h2l", "content": "A critical flaw in the WooCommerce Wholesale Lead Capture plugin (CVE-2026-27540) is being used to plant PHP webshells. Over 100,000 attacks blocked, but many sites remain vulnerable. Update to v2.0.3.2 immediately.", "creation_timestamp": "2026-09-16T11:38:38.488281Z"}, {"uuid": "fc8a5fa0-f9cd-4c8d-bcaa-d51db56e702e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mvngorqvff2t", "content": "Attackers are exploiting a critical vulnerability (CVE-2026-27540) in the WooCommerce Wholesale Lead Capture plugin, allowing them to take control of WordPress sites without authentication. The flaw, with a CVSS score of 9.8, affects versions up to 2.0.3.1.", "creation_timestamp": "2026-09-16T15:17:16.521388Z"}, {"uuid": "26afc46c-8960-4f10-9df0-489a7059c8db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "exploited", "source": "https://t.me/CyberDispatch/2963", "content": "Attackers are exploiting a critical WooCommerce Wholesale Lead Capture flaw to plant PHP web shells.\n\nWordfence has blocked over 100,000 exploit attempts since June against CVE-2026-27540, which affects versions through 2.0.3.1.", "creation_timestamp": "2026-09-17T01:00:04.494266Z"}, {"uuid": "fe942f80-c0c6-414b-8acb-8682095f6314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "exploited", "source": "https://t.me/thehackernews/10067", "content": "\ud83d\udea8 Attackers are exploiting a critical WooCommerce Wholesale Lead Capture flaw to plant PHP web shells.\n\nWordfence has blocked over 100,000 exploit attempts since June against CVE-2026-27540, which affects versions through 2.0.3.1.\n\nRead: https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html", "creation_timestamp": "2026-09-17T01:00:04.593043Z"}, {"uuid": "0c066aae-d058-46e1-adfb-47edd36afd02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "seen", "source": "https://t.me/pphm_HackerNews/3162", "content": "\ud83d\udd34 Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors\n\nThreat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin that lets unauthenticated attackers upload malicious PHP files and potentially seize full control of vulnerable WordPress sites.\n\nThe vulnerability , tracked as CVE-2026-27540, affects plugin versions 2.0.3.1 and earlier and has received a CVSS severity score of 9.8 out of 10.", "creation_timestamp": "2026-09-17T11:00:04.384242Z"}, {"uuid": "80bc7a47-9f52-47bc-a8c2-65fa2addd8d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102613", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-27540\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a winrarzipsexploit\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-17 18:44:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-27540 WWLC WordPress unauth upload RCE suite \u2014 authorized testing only\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-17T22:00:04.571494Z"}, {"uuid": "bb75aed8-00b8-40f4-8c16-c53b0721c4d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102613", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-27540\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a winrarzipsexploit\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-17 18:44:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-27540 WWLC WordPress unauth upload RCE suite \u2014 authorized testing only\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-18T00:00:05.501334Z"}, {"uuid": "af627268-6ea7-4f0a-8628-1dd7da960446", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3162", "content": "\ud83d\udd34 Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors\n\nThreat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin that lets unauthenticated attackers upload malicious PHP files and potentially seize full control of vulnerable WordPress sites.\n\nThe vulnerability , tracked as CVE-2026-27540, affects plugin versions 2.0.3.1 and earlier and has received a CVSS severity score of 9.8 out of 10.", "creation_timestamp": "2026-09-18T00:00:06.566293Z"}, {"uuid": "dc8b0820-0d02-4538-91e2-8c109a9032e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27540", "type": "published-proof-of-concept", "source": "Telegram/sREDAe6BOKB9_RGSs3URiy3vPAWvfip9ao8nlCE9pHlx5C0", "content": "", "creation_timestamp": "2026-09-18T04:00:05.296431Z"}]}