CVE-2025-3775: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentortemplateproxy function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, and can be used to query and modify information from internal services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3775?
CVE-2025-3775 is classified as a Server-Side Request Forgery vulnerability which can potentially allow unauthorized access to sensitive information.
How do I fix CVE-2025-3775?
To fix CVE-2025-3775, update the ShopLentor – WooCommerce Builder plugin to version 3.1.3 or later.
What versions are affected by CVE-2025-3775?
All versions of the ShopLentor – WooCommerce Builder for Elementor plugin up to and including version 3.1.2 are affected by CVE-2025-3775.
Who is the vendor for CVE-2025-3775?
The vendor for CVE-2025-3775 is ShopLentor, which develops the WooCommerce Builder for Elementor plugin.
What functionality is compromised by CVE-2025-3775?
CVE-2025-3775 compromises the woolentor_template_proxy function, leading to potential unauthorized server requests.