CVE-2026-6020 in ShopLentor Plugin
Summary
by MITRE • 08/05/2026
The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the 'callback' parameter.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The ShopLentor WordPress plugin presents a critical security vulnerability through its woolentoropt/v1/custom-action REST API endpoint, affecting all versions up to and including 3.3.7. This flaw stems from insufficient input validation within the handle_action() method which directly passes user-supplied parameters to the call_user_func() PHP function without any sanitization or whitelisting mechanism. The vulnerability operates under the principle of insecure deserialization and arbitrary code execution, where malicious actors can manipulate the callback parameter to invoke unintended PHP functions. This represents a severe weakness in the plugin's architecture that directly violates security best practices for API endpoint design and input handling.
The technical exploitation of this vulnerability requires an authenticated attacker with Administrator-level privileges or higher, which significantly reduces the attack surface but does not eliminate the risk entirely. Once authenticated, the malicious user can craft specific REST API requests targeting the vulnerable endpoint and include a callback parameter containing the name of any PHP callable function that exists on the server. The call_user_func() function executes whatever PHP callable is provided, potentially allowing attackers to perform actions such as reading sensitive files, modifying database content, installing backdoors, or executing arbitrary system commands depending on the server configuration and available PHP functions. This vulnerability aligns with CWE-470, which describes the use of insecure functions that can lead to arbitrary code execution.
The operational impact of this vulnerability extends beyond simple data compromise as it provides attackers with a complete backdoor into the WordPress installation through the plugin's API interface. Administrators may remain unaware of the exploitation since legitimate API requests appear normal within system logs, making detection more challenging. The vulnerability also demonstrates poor privilege separation and access control implementation, as the REST endpoint should not allow arbitrary function execution even for administrative users. This issue affects not just the plugin itself but potentially the entire WordPress site, including all installed themes, plugins, and user data. Organizations relying on ShopLentor plugin versions 3.3.7 or earlier face significant risk of complete system compromise and data breaches.
Mitigation strategies for this vulnerability should include immediate patching to version 3.3.8 or later where the issue has been resolved through proper input validation and callback whitelisting. Organizations should implement additional security measures such as restricting API endpoint access through IP whitelisting, implementing rate limiting for REST API calls, and conducting thorough monitoring of API usage patterns for suspicious activities. The fix typically involves creating a strict allowlist of permitted callbacks within the handle_action() method, ensuring that only pre-approved functions can be executed through the API interface. Security teams should also consider implementing web application firewalls to detect and block malicious API requests targeting known vulnerable endpoints, following ATT&CK technique T1059.007 for execution via API endpoints. Regular security audits of WordPress plugins and themes remain essential to identify similar vulnerabilities that could be exploited in the future.