CVE-2026-6020: ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API
The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handleaction() method passing user-supplied input directly to calluserfunc() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the 'callback' parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/plugin/ShopLentorto a version that resolves this vulnerability.Fixed in 3.3.7 - Configuration
Remediate the arbitrary function execution by ensuring handle_action() does not pass the user-supplied 'callback' parameter directly to call_user_func(); implement an allowlist of permitted callbacks for the woolentoropt/v1/custom-action endpoint.
ShopLentor woolentoropt/v1/custom-action REST API callback allowlist = Enable allowlist; reject any callback not explicitly permitted
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6020?
The severity of CVE-2026-6020 is rated as high with a score of 7.2.
What is CVE-2026-6020?
CVE-2026-6020 is a vulnerability in the ShopLentor plugin for WordPress that allows authenticated administrators to execute arbitrary functions via the callback parameter in the REST API.
How do I fix CVE-2026-6020?
To fix CVE-2026-6020, update the ShopLentor plugin to the latest version released after 3.3.7.
Who is affected by CVE-2026-6020?
CVE-2026-6020 affects users of the ShopLentor WordPress plugin version 3.3.7 and earlier who have administrator-level access.
What impact does CVE-2026-6020 have on my website?
CVE-2026-6020 can lead to remote code execution, allowing attackers to execute arbitrary PHP functions on your website.