ShopLentor <= 3.3.7 Authenticated Arbitrary Function Execution (CVE-2026-6020) Advisory

Vulnerability Overview Vulnerability Name: ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API CVE ID: CVE-2026-6020 CVSS Score: 7.2 (High) Publication Date: August 4, 2026 Last Updated: August 5, 2026 Researchers: Itthipol Aramuti (Boeing777), Waris Dankham, Teerachai Somprasong Affected Versions Affected Versions: ShopLentor <= 3.3.7 Software Type: Plugin Software Tags: woolelntor-addons (view on wordpress.org) Patched: Yes Patched Version: 3.3.8 Remediation Recommendation: Update to version 3.3.8 or a newer patched version. Vulnerability Description The ShopLentor plugin for WordPress contains an arbitrary function execution vulnerability in the REST API endpoint (in all versions <= 3.3.7). This is caused by the method passing user-supplied input directly to without maintaining an allowlist of permitted callbacks. This allows authenticated attackers with administrator-level access to execute arbitrary PHP callable functions via the 'callback' parameter. References plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Recently Discovered Vulnerabilities: - ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via optionField Parameter - ShopLentor <= 3.4.5 - Authenticated (Administrator) SQL Injection via 'orderby' Parameter - ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor) Stored Cross-Site Scripting via Product Grid 'block/loop' Block Attribute - ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute - ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolelntor_suggest_price_action' AJAX Action - ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template' - ShopLentor - WooCommerce Builder for Elementor & Gutenberg #21 Modules - All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode - ShopLentor <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting - ShopLentor - WooCommerce Builder for Elementor & Gutenberg #20 Modules - All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter - ShopLentor - WooCommerce Builder for Elementor & Gutenberg #20 Modules - All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module Summary This vulnerability allows authenticated administrators to execute arbitrary PHP functions via the 'callback' parameter of the REST API. Users are advised to update to version 3.3.8 or higher immediately to mitigate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

ShopLentor <= 3.3.7 Authenticated Arbitrary Function Execution (CVE-2026-6020) Advisory