CVE-2026-6020
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The ShopLentor plugin for WordPress up to version 3.3.7 is vulnerable to arbitrary function execution via the `woolentoropt/v1/custom-action` REST API endpoint. The `handle_action()` method passes user-supplied input directly to `call_user_func()` without an allowlist of permitted callbacks. Authenticated attackers with Administrator-level access or above can execute arbitrary PHP callable functions.
Risk Assessment
An attacker with administrator privileges can execute arbitrary PHP functions, leading to full site compromise, including malicious code execution and data theft. This can also enable privilege escalation and persistent backdoors.
Recommendation
Update the ShopLentor plugin to the latest patched version. Restrict access to the REST endpoint and implement an allowlist of permitted callbacks.
Other vulnerabilities in ShopLentor
See all- CVE-2026-92554Medium
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts if they trick a user into clicking a link.
- CVE-2026-16797Medium
The ShopLentor plugin for WordPress up to version 3.4.5 is vulnerable to Insecure Direct Object Reference via the 'optionSection' parameter. Authenticated attackers with contributor-level access or higher can read arbitrary WordPress option rows, including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records stored as arrays-of-arrays with 'title' keys.
- CVE-2026-6287Medium
The ShopLentor plugin for WordPress up to version 3.3.8 is vulnerable to stored XSS via the 'blockUniqId' attribute in Product Grid blocks. Authenticated attackers with contributor-level access can inject arbitrary scripts.
- CVE-2025-11823Medium
The ShopLentor plugin for WordPress in versions up to and including 3.2.4 is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts into pages.
Original NVD description (English source)
The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the 'callback' parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS