CVE-2026-6020

HIGH

ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-6020 has a selected CVSS score of 7.2 (high).

Description

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the 'callback' parameter.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 5, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

Browse devitemsllc / ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

Default status: unaffected

CVE ListThrough 3.3.7affected

References

4