{"cve":"CVE-2026-27540","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"[0,2.0.3.1]"}},{"platform":null,"status":"unaffected","versions":{"scheme":"generic","value":"2.0.3.2"}}],"enrichment":{"confidence":100.0,"confidence_source":"cna","scores":[{"score":100.0,"source":"cna"}]},"original":{"product":"Woocommerce Wholesale Lead Capture","source":"cna","vendor":"Rymera Web Co Pty Ltd."},"product":"woocommerce_wholesale_lead_capture","vendor":"rymera_web_co_pty_ltd."},{"configurations":[{"platform":null,"status":"unaffected","versions":null}],"enrichment":{"confidence":80.0,"confidence_source":"inferred","scores":[{"score":80.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"product":"wordpress","vendor":"wordpress"}],"created":"2026-03-19T08:54:37.379481+00:00","updated":"2026-11-05T12:30:16.753908+00:00","vendors":["rymera_web_co_pty_ltd.","rymera_web_co_pty_ltd.$PRODUCT$woocommerce_wholesale_lead_capture","wordpress","wordpress$PRODUCT$wordpress"]},"epss":{"score":0.02747},"mitre":{"cpes":[],"created":"2026-03-19T05:24:45.836000+00:00","description":"Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/27xxx/CVE-2026-27540.json","references":["https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"],"title":"WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability","updated":"2026-11-05T11:03:01.874000+00:00","vendors":[],"weaknesses":["CWE-434"]},"nvd":{"cpes":[],"created":"2026-03-19T06:16:25.787000+00:00","description":"Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.0,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-27540.json","references":["https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"],"title":null,"updated":"2026-11-05T11:16:38.767000+00:00","vendors":[],"weaknesses":["CWE-434"]},"opencve":{"changes":[{"created":"2026-03-19T06:00:00+00:00","data":[{"details":{"new":"Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through 2.0.3.1.","old":null},"type":"description"},{"details":{"new":"WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability","old":null},"type":"title"},{"details":{"added":["CWE-434"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://patchstack.com/database/wordpress/plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"2f438e12-0476-400a-bd4e-89dae54fdb98"},{"created":"2026-03-19T09:45:00+00:00","data":[{"details":["rymera_web_co_pty_ltd.","rymera_web_co_pty_ltd.$PRODUCT$woocommerce_wholesale_lead_capture","wordpress","wordpress$PRODUCT$wordpress"],"type":"first_time"},{"details":{"added":["rymera_web_co_pty_ltd.","rymera_web_co_pty_ltd.$PRODUCT$woocommerce_wholesale_lead_capture","wordpress","wordpress$PRODUCT$wordpress"],"removed":[]},"type":"vendors"}],"id":"1b688a6c-0f4e-45d3-84fc-78e5bb96ec86"},{"created":"2026-03-19T14:15:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"49a72c0e-6079-49c2-9c01-521e39017ed1"},{"created":"2026-04-23T15:00:00+00:00","data":[{"details":{"new":"Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1.","old":"Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through 2.0.3.1."},"type":"description"},{"details":{"added":["https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"],"removed":[]},"type":"references"}],"id":"5d8dfb94-7914-4275-b856-8419dc49cd86"},{"created":"2026-04-23T15:45:00+00:00","data":[{"details":{"added":[],"removed":["https://patchstack.com/database/wordpress/plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"]},"type":"references"},{"details":{"added":{},"removed":{"cvssV3_1":{"score":9.0,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}},"updated":{}},"type":"metrics"}],"id":"d1af08eb-a764-4052-aa5c-c3c1443b6b50"},{"created":"2026-04-29T10:15:00+00:00","data":[{"details":{"added":{"cvssV3_1":{"score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"f9bdbfcc-7817-4986-848e-c3e53c97dfa1"},{"created":"2026-11-05T11:15:00+00:00","data":[{"details":{"new":"Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.","old":"Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1."},"type":"description"}],"id":"a01bc62e-b3d7-4d71-b3f9-dbd6cae51387"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-03-19T05:24:45.836000+00:00","provider":"mitre"},"description":{"data":"Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.02747},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"],"providers":["mitre","nvd"]},"title":{"data":"WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability","provider":"mitre"},"updated":{"data":"2026-11-05T11:03:01.874000+00:00","provider":"mitre"},"vendors":{"data":["rymera_web_co_pty_ltd.","rymera_web_co_pty_ltd.$PRODUCT$woocommerce_wholesale_lead_capture","wordpress","wordpress$PRODUCT$wordpress"],"providers":["enrichment"]},"weaknesses":{"data":["CWE-434"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2026-03-19T05:24:45.836000+00:00","description":"Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"references":[],"title":"WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability","updated":"2026-03-19T13:47:34.727000+00:00","vendors":[],"vulnrichment_repo_path":"2026/27xxx/CVE-2026-27540.json","weaknesses":[]}}