CVE-2026-16811

Name of the Vulnerable Software and Affected Versions ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin versions prior to 3.4.6

Description An issue exists where authenticated attackers with administrator-level access and above can perform a time-based SQL Injection. This occurs due to insufficient escaping of the user-supplied orderby parameter and a lack of sufficient preparation on the existing SQL query, allowing the addition of malicious SQL queries to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 3.4.5. As a temporary mitigation, restrict access to the functionality utilizing the orderby parameter to the minimum necessary administrative users.