What is the CVSS score of CVE-2026-16797?

CVE-2026-16797 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Shoplentor All In One Woocommerce Growth Store Enhancement Plugin CVE-2026-16797

EUVD-2026-49693 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-28 Wordfence

GHSA-44qr-p5wv-c2wg

WordPress Authentication Bypass Shoplentor All In One Woocommerce Growth Store Enhancement Plugin Wordpress Plugin Devitemsllc

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 06:50 vuln.today

CVE Published

Jul 28, 2026 - 05:39 cve.org

MEDIUM 4.3

DescriptionCVE.org

The ShopLentor - All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to read arbitrary wp_options rows - including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records - whose values are stored as arrays-of-arrays containing 'title' keys, enabling cross-plugin data leakage.

AnalysisAI

Information disclosure in ShopLentor WordPress plugin versions ≤3.4.5 allows authenticated attackers with contributor-level access to read arbitrary wp_options rows whose values are stored as arrays-of-arrays containing 'title' keys, leading to cross-plugin data leakage of internal plugin news feeds, WooCommerce block pattern transients, and third-party configuration records. The vulnerability exists due to missing authorization checks on the user-controlled 'optionSection' parameter in the plugin’s API, and no public exploit or active exploitation has been reported.