Threat actors are actively exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with over 6,000 active installs. This vulnerability allows unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution. Wordfence reports blocking numerous exploitation attempts, highlighting the urgent need for users to update or remove the plugin.