Shoplentor Pro
Monthly
Broken access control in ShopLentor Pro (WordPress WooCommerce page builder plugin) versions up to and including 2.8.5 allows authenticated subscriber-level users to perform privileged actions beyond their intended authorization scope, resulting in unauthorized data or configuration modification. The flaw is network-accessible with low attack complexity and requires only a low-privilege WordPress account. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog.
Unauthenticated broken access control in ShopLentor Pro (WordPress plugin by WooLentor) versions 2.8.5 and earlier permits remote attackers without any credentials to bypass authorization controls and perform unauthorized data-modification actions against affected WooCommerce stores. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and low attack complexity against default plugin installations. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Broken access control in ShopLentor Pro (WordPress WooCommerce page builder plugin) versions up to and including 2.8.5 allows authenticated subscriber-level users to perform privileged actions beyond their intended authorization scope, resulting in unauthorized data or configuration modification. The flaw is network-accessible with low attack complexity and requires only a low-privilege WordPress account. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog.
Unauthenticated broken access control in ShopLentor Pro (WordPress plugin by WooLentor) versions 2.8.5 and earlier permits remote attackers without any credentials to bypass authorization controls and perform unauthorized data-modification actions against affected WooCommerce stores. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and low attack complexity against default plugin installations. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.