← Back to search

CVE-2026-6020

7.2 HIGH

Published 2026-08-05 · Updated 2026-08-05

AI risk analysis

Summary
The flaw allows arbitrary function execution via an unfiltered user input parameter, enabling authenticated attackers with Administrator-level access to run any PHP code.
Exploitability
Exploitation requires Administrator privileges and involves sending a crafted request to the REST API endpoint; moderately difficult.
Blast radius
If exploited, it could lead to full control over the WordPress site, including data theft, defacement, or complete compromise.
Prioritized remediation
Update to the latest version of ShopLentor plugin immediately or disable the vulnerable custom-action endpoint.
rceauth-bypasswebphp

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the 'callback' parameter.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-470

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.