CVE-2026-6020 devitemsllc CVE debrief

Who should care

Administrators of WordPress installations using the ShopLentor plugin, security teams monitoring for vulnerabilities in WordPress plugins, users with Administrator-level access to affected systems, and operators of platforms that use the ShopLentor plugin should be aware of this vulnerability. They should review the plugin's code, check for suspicious activity, and apply the vendor's official patch or upgrade to a version that addresses this vulnerability. The vulnerability has a high priority due to the potential for arbitrary function execution with Administrator-level access.

Technical summary

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint. The handle_action() method passes user-supplied input directly to call_user_func() without an allowlist of permitted callbacks, allowing authenticated attackers with Administrator-level access to execute arbitrary PHP callable functions. This vulnerability has a high impact on the confidentiality, integrity, and availability of the affected system. The affected product is the ShopLentor plugin for WordPress, and the vulnerability is triggered by user-supplied input to the custom-action REST API endpoint.

Defensive priority

High priority due to the vulnerability allowing arbitrary function execution with Administrator-level access.

Recommended defensive actions

• Apply the vendor's official patch or upgrade to a version that addresses this vulnerability.
• Restrict access to the REST API endpoint to only trusted users.
• Monitor for suspicious activity on the affected system.
• Consider implementing a web application firewall (WAF) to detect and prevent attacks.
• Review the plugin's code and check for suspicious activity.
• Perform a thorough review of the affected system's logs to identify potential security incidents.
• Implement additional security measures, such as two-factor authentication, to prevent exploitation.

Evidence notes

The vulnerability exists in the ShopLentor plugin for WordPress, specifically in the woolentoropt/v1/custom-action REST API endpoint. The handle_action() method does not have an allowlist of permitted callbacks, allowing user-supplied input to be passed directly to call_user_func(). To verify, defenders should review the plugin's code and check for any suspicious activity on the affected system. The evidence is limited to the provided CVE record and NVD detail.

Official resources