WAF Watch: WooCommerce webshells, Drupal CKEditor, campus SAML
Mac Clark · September 16, 2026
Monday’s Watch covered calendars, Elementor forms, a Drupal table-field bypass, and a campus outage lesson. This mid-week catch-up picks up what landed since then — plus one campus SSO topic we hadn’t put on the checklist yet. Fear is cheap; checklists are useful.
ProtectMyWebsite is the WAF that tells you what’s safe to block — rules start in count, then your dashboard shows what to promote. You still decide.
1. WooCommerce Wholesale Lead Capture — webshell campaign still running (CVE-2026-27540)
Wordfence’s September 14 write-up (picked up by BleepingComputer on the 15th and The Hacker News / Infosecurity Magazine on the 16th) says its firewall has blocked 100,000+ exploit attempts against CVE-2026-27540 in Rymera’s premium WooCommerce Wholesale Lead Capture plugin (~6,000 installs). Affected: all versions through 2.0.3.1. Fixed in 2.0.3.2 (February 20). Patchstack scored the CVE 9.0; Wordfence rates it 9.8. NVD has the identifier.
The bug is an unauthenticated arbitrary file upload on the AJAX action wwlc_file_upload_handler. The handler checks extensions against an allowlist taken from the attacker-controlled file_settings request parameter — so an unauthenticated visitor can add php to the list and land a webshell (often shell.php) that phones home host details and offers a browser upload form for more malware. Activity spiked June 4–17, July 1, and August 30; attempts were still landing in the last day of Wordfence’s window.
Campus / agency angle: bookstore wholesale signup, foundation vendor portals, and “temporary” WooCommerce microsites that never make the central CMS inventory. Same forgotten-form blast radius as last week’s Elementor upload story — different plugin, same class of mistake.
Do this: Confirm every Wholesale Lead Capture install is on 2.0.3.2+ (or remove the plugin if unused). Sweep wp-content/uploads/ for unexpected .php. Grep access logs for admin-ajax.php with action=wwlc_file_upload_handler. Review for unknown admin accounts. At the edge, put body-aware virtual-patch rules for forged file_settings / PHP upload abuse in count first — promote when hits look like scanners, not real wholesale applicants.
2. Drupal core — CKEditor XSS via third-party library (SA-CORE-2026-013)
On September 16 Drupal published SA-CORE-2026-013: moderately critical (13/25) third-party library issue. CKEditor shipped a high-severity XSS in its engine package; Drupal’s advisory covers sites that use CKEditor for WYSIWYG editing. An attacker who can create or edit content (even without CKEditor UI access themselves) may target users who do have the editor — including privileged admins. Affected: Drupal ≥10.5.0 <10.6.17, ≥11.0.0 <11.3.17, and ≥11.4.0 <11.4.7.
Do this: Update to 10.6.17, 11.3.17, or 11.4.7 as appropriate for your branch. Drupal 10.5.x and 11.2.x (and below) are end-of-life and do not receive this coverage — plan the upgrade path. After core update, review contributed modules that ship extra CKEditor plugins outside core’s package. Edge XSS / content-injection signatures against editor and content-create paths belong in count while estates roll; promote only when traffic looks like probes, not faculty editors saving pages.
3. Drupal miniOrange SAML SSO — multi-advisory campus auth patch (SA-CONTRIB-2026-141+)
On September 9 Drupal published a batch of advisories against SAML SSO – Service Provider (miniorange_saml) — the kind of module that shows up on .edu and agency Drupal estates that federate login. Highlights include critical improper access control (SA-CONTRIB-2026-141, CVE-2026-87943), improper certificate validation (SA-CONTRIB-2026-142), open redirect (SA-CONTRIB-2026-143), and moderately critical authentication bypass (SA-CONTRIB-2026-145), plus related SSRF / replay / XSS / crypto findings in the same series. Fixed release called out across the batch: 3.2.0. See the contrib security index. We skipped this in Monday’s Watch (that post stayed on Ultimate Table Field); it belongs on the mid-week checklist.
Campus / agency angle: when SSO config or assertion handling is wrong, the blast radius is every app that trusts that IdP handshake — student portal, staff intranet, FOIA intake behind SSO, research collaboration sites.
Do this: Inventory every Drupal property using miniorange_saml (including departmental orphans). Upgrade to 3.2.0 (or newer fixed release your composer pin allows), clear caches, and test login / logout / role mapping in staging before prod. At the edge, challenge and rate-limit SAML ACS / metadata / SSO callback paths in count so you don’t lock out Monday-morning campus traffic while you promote.
Tip of the week
AJAX upload handlers that trust the request for their allowlist are why count mode exists.
This catch-up’s WordPress item is not a pretty URL exploit — it rides an unauthenticated admin-ajax.php action and a forged settings blob. The wrong move is flipping every new signature to deny on day one and breaking a bookstore wholesale signup or a vendor registration form. The right move:
- Deploy (or request) virtual-patch rules that inspect POST bodies and AJAX action names, not only paths.
- Leave them in count against real traffic.
- After about a day, open the dashboard — it shows what’s safe to block.
- One click to promote. You stay in the loop.
That’s how we run ProtectMyWebsite: rules start in count; after 24 hours the dashboard shows what’s safe to block — one click. Promote Copilot reads your count window and explains what's safe to promote — you still click once. Copilot explains only — no auto-block.
$150/site/mo with a 14-day trial. Refer a friend: 10% off for 3 months for both sides.
Campus Estate is quote on request — talk to sales team. We do not publish Estate list prices.
If you run campus or agency sites: scan your site, see what WAF count mode is, what's safe to block on a WAF, managed WAF for university and college websites, managed WAF for government and public-sector websites, and start a 14-day trial.