CVE-2025-12493

CRITICAL

ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-12493 has a selected CVSS score of 9.8 (critical).

Description

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 4, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

Browse devitemsllc / ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

Default status: unaffected

CVE ListThrough 3.2.5affected

References

5