Vulnerabilities / ShopLentor / WPSEC-2026-2863
ShopLentor <= 3.5.7 - Unauthenticated Arbitrary Shortcode Execution via Gutenberg Template Rendering
Medium 6.5
CWE-94Fixed in 3.5.8
- ID
- WPSEC-2026-2863
- Plugin
- ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (woolentor-addons)
- Affected
- all versions before 3.5.8
- Remediation
- Update to 3.5.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- ShopLentor on WPSec AttackSurface
- Fix released
- Published
Description
The ShopLentor plugin for WordPress is vulnerable to arbitrary shortcode execution via Gutenberg-built WooCommerce templates in all versions up to, and including, 3.5.7. This is due to the plugin running do_shortcode() on the rendered output of the template's blocks, which can contain visitor-supplied data such as the search term shown by the Archive Title block on product search results. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on sites using block-built ShopLentor templates.
References
- https://wpsec.com/vuln/WPSEC-2026-2863/
- https://plugins.svn.wordpress.org/woolentor-addons/tags/3.5.8/
- https://wordpress.org/plugins/woolentor-addons/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS