Junglewise Threat Intelligence

CVE-2026-16797: ShopLentor IDOR in WooCommerce Growth & Store Enhancement Plugin

CVE-2026-16797 · Severity: medium · CVSS 4.3 · Published 2026-07-28

Executive brief

ShopLentor, a popular WordPress plugin used to enhance WooCommerce online stores, contains a security flaw that allows users with low-level account access (such as contributors) to view sensitive internal data. An attacker could exploit this to read configuration records and news feed data from other plugins installed on the site. While this does not allow for full site takeover, it leads to unauthorized data exposure and could reveal information about the site's configuration.

Technical details

The ShopLentor plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability due to missing validation on the 'optionSection' parameter within its API classes. Authenticated attackers with contributor-level permissions or higher can exploit this by providing a user-controlled key to read arbitrary rows from the 'wp_options' table. The vulnerability specifically impacts data stored as arrays-of-arrays containing 'title' keys, which includes internal plugin news feeds, WooCommerce block pattern transients, and various third-party configuration records. This results in cross-plugin data leakage. The issue was addressed in a changeset following version 3.4.5.

Affected products

  • devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin up to, and including, 3.4.5

Timeline

  • 2026-07-28: advisory: NVD publication date
  • 2026-07-28: disclosed: Wordfence advisory published

References