Hackers Deploy PHP Webshells via WooCommerce Vulnerability in WordPress Sites

Security researchers have identified a coordinated campaign that leverages a critical flaw in a widely used WooCommerce add‑on to drop PHP webshells onto WordPress installations. The flaw, present in a third‑party extension that handles product imports, enables threat actors to upload arbitrary PHP files without proper authentication, effectively handing the attacker remote code execution capabilities on compromised sites.

The vulnerability stems from inadequate input validation in the plugin's file‑handling routine. By submitting a crafted request, an attacker can bypass the usual WordPress media upload restrictions and place a malicious script in a web‑accessible directory. Once the webshell is in place, it can be used to execute commands, exfiltrate data, or install additional malware, turning a legitimate e‑commerce site into a foothold for broader network attacks.

Because WooCommerce powers a large segment of the e‑commerce ecosystem—estimated to be used by hundreds of thousands of WordPress sites—the potential impact is significant. Analysts monitoring the activity, as reported by Infosecurity Magazine, note that the campaign appears to be automated, targeting sites that have not applied recent updates. Compromised stores risk exposure of customer information, payment details, and could be leveraged for ransomware distribution or denial‑of‑service attacks.

The plugin’s maintainer has responded by issuing an emergency patch that tightens file‑type checks and enforces authentication for upload endpoints. The WordPress security team has echoed the recommendation, urging site owners to apply the update immediately, review file permissions, and run integrity scans with reputable security tools. Experts also advise the deployment of web‑application firewalls and the disabling of unused plugins to reduce the attack surface.

While the current focus is on this specific WooCommerce flaw, the incident underscores a broader challenge: the reliance on third‑party code that may not undergo rigorous security review. Industry observers expect attackers to pivot toward other popular extensions if similar weaknesses are found. Ongoing monitoring by security firms and timely patch management remain critical to protecting the WordPress ecosystem from similar webshell campaigns.