Dashboard / CVE-2026-27540

CVE-2026-27540

CRITICAL 1 PoC
INFO Priority: 0.25 BB Relevance: 79/100
Published: 2026-03-19 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network No Auth No Interaction Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: Changed
C: High
I: High
A: High

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Using Malicious Files. This issue affects Woocommerce Wholesale Lead Capture: through 2.0.3.1.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture 0

References & Advisories (1)

Proof of Concept (1)

—
https://github.com/winrarzipsexploit/CVE-2026-27540
nomi-sec

Bug Bounty Relevance

79 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction
✓ PoC available (1)

CVSS Score

9.0 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploitation Probability

2.75%
Raw Score 0.027470
Percentile 86.3%
Date 2026-11-10

EPSS Trend

2026-11-10
0.02747
2026-11-09
0.02747
2026-11-08
0.02747
2026-11-07
0.02747
2026-11-06
0.02747
2026-11-05
0.02747
2026-11-04
0.02688

Intelligence Sources

mitre ref →
nvd ref →

External Links