CVE-2026-6020

Name of the Vulnerable Software and Affected Versions ShopLentor versions prior to 3.3.8

Description The ShopLentor plugin for WordPress allows arbitrary function execution through the 'woolentoropt/v1/custom-action' REST API endpoint. The issue occurs because the handle action() method passes user-supplied input to the call user func() function without validating it against an allowlist of permitted callbacks. Consequently, authenticated attackers with Administrator-level access or higher can execute arbitrary PHP callable functions by manipulating the callback parameter.

Recommendations Update ShopLentor to version 3.3.8 or later. As a temporary mitigation, restrict access to the 'woolentoropt/v1/custom-action' REST API endpoint.