cve-2026-27540
CRITICAL CVSS 9.0 opencve
Description
Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files. This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.
Timeline
- Published
- 2026-03-19 06:16 UTC
- Last Modified
- 2026-11-05
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 3.1 | 9.0 | CRITICAL | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
mitre | ||
| 3.1 | 9.0 | CRITICAL | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
nvd | ||
| 3.1 | 9.0 | CRITICAL | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
opencve |
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cve": "CVE-2026-27540",
"enrichment": {
"affected": [
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "generic",
"value": "[0,2.0.3.1]"
}
},
{
"platform": null,
"status": "unaffected",
"versions": {
"scheme": "generic",
"value": "2.0.3.2"
}
}
],
"enrichment": {
"confidence": 100.0,
"confidence_source": "cna",
"scores": [
{
"score": 100.0,
"source": "cna"
}
]
},
"original": {
"product": "Woocommerce Wholesale Lead Capture",
"source": "cna",
"vendor": "Rymera Web Co Pty Ltd."
},
"product": "woocommerce_wholesale_lead_capture",
"vendor": "rymera_web_co_pty_ltd."
},
{
"configurations": [
{
"platform": null,
"status": "unaffected",
"versions": null
}
],
"enrichment": {
"confidence": 80.0,
"confidence_source": "inferred",
"scores": [
{
"score": 80.0,
"source": "inferred"
},
{
"score": 100.0,
"source": "matching"
}
]
},
"product": "wordpress",
"vendor": "wordpress"
}
],
"created": "2026-03-19T08:54:37.379481+00:00",
"updated": "2026-11-05T12:30:16.753908+00:00",
"vendors": [
"rymera_web_co_pty_ltd.",
"rymera_web_co_pty_ltd.$PRODUCT$woocommerce_wholesale_lead_capture",
"wordpress",
"wordpress$PRODUCT$wordpress"
]
},
"epss": {
"score": 0.02747
},
"mitre": {
"cpes": [],
"created": "2026-03-19T05:24:45.836000+00:00",
"description": "Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 9,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"mitre_repo_path": "cves/2026/27xxx/CVE-2026-27540.json",
"references": [
"https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"
],
"title": "WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability",
"updated": "2026-11-05T11:03:01.874000+00:00",
"vendors": [],
"weaknesses": [
"CWE-434"
]
},
"nvd": {
"cpes": [],
"created": "2026-03-19T06:16:25.787000+00:00",
"description": "Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 9.0,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"nvd_repo_path": "2026/CVE-2026-27540.json",
"references": [
"https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"
],
"title": null,
"updated": "2026-11-05T11:16:38.767000+00:00",
"vendors": [],
"weaknesses": [
"CWE-434"
]
},
"opencve": {
"changes": [
{
"created": "2026-03-19T06:00:00+00:00",
"data": [
{
"details": {
"new": "Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through 2.0.3.1.",
"old": null
},
"type": "description"
},
{
"details": {
"new": "WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability",
"old": null
},
"type": "title"
},
{
"details": {
"added": [
"CWE-434"
],
"removed": []
},
"type": "weaknesses"
},
{
"details": {
"added": [
"https://patchstack.com/database/wordpress/plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {
"cvssV3_1": {
"score": 9,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "2f438e12-0476-400a-bd4e-89dae54fdb98"
},
{
"created": "2026-03-19T09:45:00+00:00",
"data": [
{
"details": [
"rymera_web_co_pty_ltd.",
"rymera_web_co_pty_ltd.$PRODUCT$woocommerce_wholesale_lead_capture",
"wordpress",
"wordpress$PRODUCT$wordpress"
],
"type": "first_time"
},
{
"details": {
"added": [
"rymera_web_co_pty_ltd.",
"rymera_web_co_pty_ltd.$PRODUCT$woocommerce_wholesale_lead_capture",
"wordpress",
"wordpress$PRODUCT$wordpress"
],
"removed": []
},
"type": "vendors"
}
],
"id": "1b688a6c-0f4e-45d3-84fc-78e5bb96ec86"
},
{
"created": "2026-03-19T14:15:00+00:00",
"data": [
{
"details": {
"added": {
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "49a72c0e-6079-49c2-9c01-521e39017ed1"
},
{
"created": "2026-04-23T15:00:00+00:00",
"data": [
{
"details": {
"new": "Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1.",
"old": "Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through 2.0.3.1."
},
"type": "description"
},
{
"details": {
"added": [
"https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"
],
"removed": []
},
"type": "references"
}
],
"id": "5d8dfb94-7914-4275-b856-8419dc49cd86"
},
{
"created": "2026-04-23T15:45:00+00:00",
"data": [
{
"details": {
"added": [],
"removed": [
"https://patchstack.com/database/wordpress/plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"
]
},
"type": "references"
},
{
"details": {
"added": {},
"removed": {
"cvssV3_1": {
"score": 9.0,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
},
"updated": {}
},
"type": "metrics"
}
],
"id": "d1af08eb-a764-4052-aa5c-c3c1443b6b50"
},
{
"created": "2026-04-29T10:15:00+00:00",
"data": [
{
"details": {
"added": {
"cvssV3_1": {
"score": 9,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "f9bdbfcc-7817-4986-848e-c3e53c97dfa1"
},
{
"created": "2026-11-05T11:15:00+00:00",
"data": [
{
"details": {
"new": "Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.",
"old": "Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1."
},
"type": "description"
}
],
"id": "a01bc62e-b3d7-4d71-b3f9-dbd6cae51387"
}
],
"cpes": {
"data": [],
"providers": []
},
"created": {
"data": "2026-03-19T05:24:45.836000+00:00",
"provider": "mitre"
},
"description": {
"data": "Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {
"score": 9,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
},
"provider": "mitre"
},
"cvssV4_0": {
"data": {},
"provider": null
},
"epss": {
"data": {
"score": 0.02747
},
"provider": "first"
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
},
"provider": "vulnrichment"
},
"threat_severity": {
"data": null,
"provider": null
}
},
"references": {
"data": [
"https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability?_s_id=cve"
],
"providers": [
"mitre",
"nvd"
]
},
"title": {
"data": "WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability",
"provider": "mitre"
},
"updated": {
"data": "2026-11-05T11:03:01.874000+00:00",
"provider": "mitre"
},
"vendors": {
"data": [
"rymera_web_co_pty_ltd.",
"rymera_web_co_pty_ltd.$PRODUCT$woocommerce_wholesale_lead_capture",
"wordpress",
"wordpress$PRODUCT$wordpress"
],
"providers": [
"enrichment"
]
},
"weaknesses": {
"data": [
"CWE-434"
],
"providers": [
"mitre",
"nvd"
]
}
},
"vulnrichment": {
"cpes": [],
"created": "2026-03-19T05:24:45.836000+00:00",
"description": "Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files.\n\nThis issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {},
"kev": {},
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"references": [],
"title": "WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability",
"updated": "2026-03-19T13:47:34.727000+00:00",
"vendors": [],
"vulnrichment_repo_path": "2026/27xxx/CVE-2026-27540.json",
"weaknesses": []
}
}