HIGHVulnerability
CVE-2026-6020
The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the 'callback' parameter.
Properties
- severity
- HIGH
- score
- 7.2
- cve_id
- CVE-2026-6020
- vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- published_at
- 2026-08-05T08:16:40.850
- last_modified
- 2026-08-12T21:00:37.147
Related Entities (2)
HAS_WEAKNESS (1)
→[Weakness]Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph