CVE-2026-16797
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The ShopLentor plugin for WordPress up to version 3.4.5 is vulnerable to Insecure Direct Object Reference via the 'optionSection' parameter. Authenticated attackers with contributor-level access or higher can read arbitrary WordPress option rows, including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records stored as arrays-of-arrays with 'title' keys.
Risk Assessment
This could lead to leakage of sensitive configuration data across plugins, potentially exposing confidential store information and integration details.
Recommendation
Immediately update the ShopLentor plugin to the latest available version that addresses this vulnerability.
Other vulnerabilities in ShopLentor
See all- CVE-2026-92554Medium
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts if they trick a user into clicking a link.
- CVE-2026-6020High
The ShopLentor plugin for WordPress up to version 3.3.7 is vulnerable to arbitrary function execution via the `woolentoropt/v1/custom-action` REST API endpoint. The `handle_action()` method passes user-supplied input directly to `call_user_func()` without an allowlist of permitted callbacks. Authenticated attackers with Administrator-level access or above can execute arbitrary PHP callable functions.
- CVE-2026-6287Medium
The ShopLentor plugin for WordPress up to version 3.3.8 is vulnerable to stored XSS via the 'blockUniqId' attribute in Product Grid blocks. Authenticated attackers with contributor-level access can inject arbitrary scripts.
- CVE-2025-11823Medium
The ShopLentor plugin for WordPress in versions up to and including 3.2.4 is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts into pages.
Original NVD description (English source)
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to read arbitrary wp_options rows — including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records — whose values are stored as arrays-of-arrays containing 'title' keys, enabling cross-plugin data leakage.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS