What is the CVSS score of CVE-2026-61972?

CVE-2026-61972 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

ShopLentor Pro CVE-2026-61972

EUVD-2026-48211 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-cxp4-9f6c-272w

WordPress Authentication Bypass Wordpress Plugin Shoplentor Pro

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable endpoint with no auth required per CWE-862 missing authorization; impact is write-only with no confidentiality or availability consequence confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:31 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

AnalysisAI

Unauthenticated broken access control in ShopLentor Pro (WordPress plugin by WooLentor) versions 2.8.5 and earlier permits remote attackers without any credentials to bypass authorization controls and perform unauthorized data-modification actions against affected WooCommerce stores. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and low attack complexity against default plugin installations. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Technical ContextAI

ShopLentor Pro is a premium WooCommerce-oriented WordPress plugin developed by WooLentor (HaspTech), identified by CPE cpe:2.3:a:woolentor:shoplentor_pro:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization), a class of flaw in which one or more plugin-registered endpoints - typically WordPress REST API routes or admin-ajax.php handlers - execute sensitive operations without verifying that the caller holds appropriate WordPress capabilities or a valid security nonce. In WordPress plugin architecture, this commonly arises when developers register action hooks accessible to unauthenticated users but omit current_user_can() or check_ajax_referer() guards, allowing any HTTP client to invoke privileged functionality. The missing authorization is tagged as an Authentication Bypass by Patchstack, indicating the access control gate is absent rather than merely weak.

RemediationAI

Upgrade ShopLentor Pro to a version released after 2.8.5. No specific patched version number is confirmed in the available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woolentor-addons-pro/vulnerability/wordpress-shoplentor-pro-plugin-2-8-5-broken-access-control-vulnerability and the plugin's official changelog on the WooLentor website or WordPress plugin repository to identify the first release that addresses this issue. If an immediate upgrade is not feasible, a compensating control is to use a Web Application Firewall (WAF) such as Patchstack's virtual patching, Cloudflare WAF, or Wordfence to block unauthenticated requests to the specific plugin AJAX or REST endpoints involved - though the exact endpoint names are not disclosed in available data, which limits precision of WAF rule crafting. Temporarily deactivating the plugin eliminates exposure entirely but removes its functionality.