ShopLentor <= 3.4.5 IDOR Vulnerability Advisory (CVE-2026-16797)

Vulnerability Overview Vulnerability Name: ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter CVE ID: CVE-2026-16797 CVSS Score: 4.3 (Medium) Publication Date: July 27, 2026 Last Updated: July 28, 2026 Researchers: Wordfence PRISM - Wordfence Impact Scope Software Type: Plugin Software Name: ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin Affected Versions: <= 3.4.5 Fixed Versions: 3.4.6 Remediation Recommendation: Update to version 3.4.6 or later patched versions Additional Information Authorization Bypass via User-Controlled Key: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Vulnerabilities ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via orderby Parameter - CVE ID: CVE-2026-16811 - CVSS Score: 4.9 - Researchers: Wordfence PRISM - Publication Date: July 27, 2026 ShopLentor – WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockAlign' Block Attribute - CVE ID: CVE-2026-6287 - CVSS Score: 5.4 - Researchers: ammonia - Publication Date: May 26, 2026 ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute - CVE ID: CVE-2026-4059 - CVSS Score: 6.4 - Researchers: zam - Publication Date: April 13, 2026 ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action - CVE ID: CVE-2026-1714 - CVSS Score: 8.6 - Researchers: Teerachai Somprasong - Publication Date: February 17, 2026 ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template' - CVE ID: CVE-2025-12493 - CVSS Score: 9.8 - Researchers: mkemerys - Publication Date: November 3, 2025 ShopLentor – WooCommerce Builder for Elementor & Gutenberg <= 2.1 Modules – All in One Solution (formerly WooLentor) <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode - CVE ID: CVE-2025-11823 - CVSS Score: 6.4 - Researchers: theviper17y - Publication Date: October 24, 2025 ShopLentor <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2025-58990 - CVSS Score: 6.4 - Researchers: Denver Jackson - Publication Date: September 9, 2025 ShopLentor – WooCommerce Builder for Elementor & Gutenberg <= 2.0 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter - CVE ID: CVE-2025-3775 - CVSS Score: 6.5 - Researchers: mkemerys - Publication Date: April 24, 2025 ShopLentor – WooCommerce Builder for Elementor & Gutenberg <= 2.0 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module - CVE ID: CVE-2025-1527 - CVSS Score: 6.4 - Researchers: Webbeaut - Publication Date: March 11, 2025 ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL FAQ Widget Elementor Template - CVE ID: CVE-2024-9538 - CVSS Score: 4.3 - Researchers: Ankil Patel - Publication Date: October 10, 2024 Summary This page details multiple security vulnerabilities in the ShopLentor plugin, including SQL Injection, Cross-Site Scripting (XSS), Local File Inclusion (LFI), and Server-Side Request Forgery (SSRF). Information such as CVE IDs, CVSS scores, researchers, and publication dates is provided for each vulnerability. Users are advised to update to the latest version as soon as possible to patch these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

ShopLentor <= 3.4.5 IDOR Vulnerability Advisory (CVE-2026-16797)