# ShopLentor <= 3.5.7 - Unauthenticated Arbitrary Shortcode Execution via Gutenberg Template Rendering

- **ID:** WPSEC-2026-2863
- **Plugin:** ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (`woolentor-addons`), https://wordpress.org/plugins/woolentor-addons/
- **Affected versions:** all versions before 3.5.8
- **Fixed in:** 3.5.8 (Update to 3.5.8 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woolentor-addons
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2863/

## Description

The ShopLentor plugin for WordPress is vulnerable to arbitrary shortcode execution via Gutenberg-built WooCommerce templates in all versions up to, and including, 3.5.7. This is due to the plugin running do_shortcode() on the rendered output of the template's blocks, which can contain visitor-supplied data such as the search term shown by the Archive Title block on product search results. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on sites using block-built ShopLentor templates.

## References

- https://wpsec.com/vuln/WPSEC-2026-2863/
- https://plugins.svn.wordpress.org/woolentor-addons/tags/3.5.8/
- https://wordpress.org/plugins/woolentor-addons/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2863/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.