CVE-2026-27540

CriticalCVSS 9.0/10Last modified Nov 5, 2026

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.

This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Rymera Web Co Pty Ltd.	Woocommerce Wholesale Lead Capture	<= 2.0.3.1

References

https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve

Timeline

Published: Mar 19, 2026
Last modified: Nov 5, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-275417.2Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite allows Privilege Escalation. This issue affects Wholesale Sui CVE-2026-275429.8Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Privilege Escalation. This CVE-2026-275438.1Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.CVE-2026-2754410.0Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.CVE-2026-275454.7OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute comma CVE-2026-275469.8An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accoun CVE-2026-275478.8A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using vali CVE-2026-275488.8A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user CVE-2026-275498.8A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint usi CVE-2026-275508.8A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials CVE-2026-275518.8A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user cr CVE-2026-275528.1A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD