WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation

criticalseverity

9.8CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture <= 2.0.3.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.

Impact

Attackers can escalate their privileges, potentially gaining unauthorized access to restricted functions or data.

Fix

Update to the latest version beyond 2.0.3.1.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/woocommerce-wholesale-lead-capture/readme.txt
Positive when: status_code == 200 and contains(body, "WooCommerce Wholesale Lead Capture") and compare_versions(version, "<= 2.0.3.1")
Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and !regex("^(-1|0)\\s*$", body) && len(body) > 2 and contains_all(body, "wwlc_firstname", "wwlc_email")

Run it with nuclei: nuclei -id CVE-2026-27542 -u <target>

The full check

id: CVE-2026-27542

info:
  name: WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation
  author: theamanrawat,pdresearch
  severity: critical
  description: |
    Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture <= 2.0.3.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.
  impact: |
    Attackers can escalate their privileges, potentially gaining unauthorized access to restricted functions or data.
  remediation: |
    Update to the latest version beyond 2.0.3.1.
  reference:
    - https://github.com/Nxploited/CVE-2026-27542-CVE-2026-27540-
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-wholesale-lead-capture
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27542
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-27542
    epss-score: 0.01776
    epss-percentile: 0.78388
    cwe-id: CWE-266
  metadata:
    verified: true
    max-request: 2
    vendor: rymera-web-co
    product: woocommerce-wholesale-lead-capture
    framework: wordpress
    fofa-query: body="/wp-content/plugins/woocommerce-wholesale-lead-capture/"
    shodan-query: http.html:"/wp-content/plugins/woocommerce-wholesale-lead-capture/"
    publicwww-query: "/wp-content/plugins/woocommerce-wholesale-lead-capture/"
  tags: cve,cve2026,wp,wordpress,woocommerce,wholesale,privesc,unauth,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/woocommerce-wholesale-lead-capture/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "WooCommerce Wholesale Lead Capture")'
          - 'compare_versions(version, "<= 2.0.3.1")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '(?m)Stable tag:\s+([0-9]+\.[0-9]+(?:\.[0-9]+(?:\.[0-9]+)*)?)'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Content-Type: application/x-www-form-urlencoded

        action=wwlc_create_user

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - '!regex("^(-1|0)\\s*$", body) && len(body) > 2'
          - 'contains_all(body, "wwlc_firstname", "wwlc_email")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from