ShopLentor CVE-2026-6020

Exploitation requires the attacker to hold an authenticated WordPress session with Administrator-level privileges or higher - confirmed by the CVSS PR:H metric. The woolentoropt/v1/custom-action REST API endpoint must be reachable over the network (default for any internet-accessible WordPress site with the plugin active and REST API not externally blocked). No additional non-default configuration is required beyond having the ShopLentor plugin installed and activated on WordPress. What limits exploitation: the Administrator privilege prerequisite is the primary constraint - an unauthenticated or low-privilege attacker cannot exploit this vulnerability. The attack surface is further bounded to WordPress sites running ShopLentor versions 3.3.7 and below with REST API access enabled.

The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately reflects the technical impact but the PR:H metric is the critical limiting factor in real-world risk: exploitation requires an attacker to already hold WordPress Administrator credentials or higher. This substantially constrains the realistic threat model to scenarios involving credential theft, phishing of site admins, brute-force of admin accounts, or a malicious insider. No EPSS data was provided in the intelligence feed; given the admin-level prerequisite, exploitation probability against an uncompromised, properly-credentialed site is low. There is no CISA KEV listing and no public proof-of-concept exploit identified, which aligns with the elevated access barrier. The CVSS scope component (S:U) correctly indicates no cross-site or cross-container boundary crossing. The principal real-world risk is privilege escalation abuse on multi-tenant WordPress hosts or compromised admin credential scenarios - not opportunistic mass exploitation.

An attacker who has obtained WordPress administrator credentials - through phishing, credential stuffing, or a compromised admin account - authenticates to the target WordPress site and sends a crafted HTTP POST request to /wp-json/woolentoropt/v1/custom-action with a 'callback' parameter set to a dangerous PHP built-in such as system, passthru, or a class method reference. The handle_action() method passes this value directly to call_user_func(), executing the specified PHP function with the web server's runtime privileges and enabling arbitrary command execution, file manipulation, or data exfiltration. No public proof-of-concept exploit code has been identified, but the attack is trivially constructable from the source code reference at Custom_Actions.php#L99.