CVE-2026-6020
Received Received - Intake

Arbitrary Function Execution in ShopLentor WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Wordfence

Description
The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the 'callback' parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-6020
EUVD
EUVD-2026-53284

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woolentor shoplentor to 3.3.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The ShopLentor WordPress plugin has a vulnerability in versions up to 3.3.7 where the woolentoropt/v1/custom-action REST API endpoint allows arbitrary function execution. The handle_action() method uses user input directly in call_user_func() without restricting allowed callbacks, enabling authenticated attackers with admin access to execute any PHP function via the callback parameter.

Detection Guidance

Check for unauthorized use of the woolentoropt/v1/custom-action REST API endpoint. Inspect WordPress logs for suspicious callback parameter usage in requests to this endpoint. Look for Administrator-level access attempts to this API.

Impact Analysis

If you use the ShopLentor plugin with admin access, an attacker could exploit this to run malicious PHP code on your WordPress site. This could lead to complete site takeover, data theft, or further compromise of your server. The attack requires admin privileges but could be combined with other exploits.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules. A breach may require breach notifications, fines, or other compliance penalties depending on the data exposed.

Mitigation Strategies

Immediately update the ShopLentor plugin to the latest version if available. If not, disable the plugin until a patch is released. Restrict Administrator-level access to only necessary users. Monitor for unusual activity in WordPress logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6020. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart