Critical · published November 4, 2025
🚨 An unauthenticated attacker can run any PHP code they choose using this local file inclusion vulnerability in the ShopLentor plugin for WordPress! 🔥 Think of it like a restaurant that allows diners to order their meals from the kitchen directly without confirming their reservations — if someone walks in off the street, they could request anything from the chef’s secret menu! This vulnerability could lead to devastating consequences for your website, allowing attackers to bypass access controls, steal sensitive data, or even execute malicious code on your server. Imagine the chaos that could ensue if they accessed your database or altered your site’s functionality — it’s absolutely critical to act now!
Think of it like a restaurant that allows diners to order their meals from the kitchen directly without confirming their reservations — if someone walks in off the street, they could request anything from the chef’s secret menu! The ShopLentor plugin is vulnerable to Local File Inclusion through its 'load_template' function, enabling attackers to include and execute arbitrary .php files hosted on the server. This opens the door to potentially harmful code execution without needing to authenticate.
This vulnerability could lead to devastating consequences for your website, allowing attackers to bypass access controls, steal sensitive data, or even execute malicious code on your server. Imagine the chaos that could ensue if they accessed your database or altered your site’s functionality — it’s absolutely critical to act now! Immediately update the ShopLentor plugin to version 3.2.6 or later to close this vulnerability. Additionally, review your server’s configurations to prevent unauthorized file access and ensure proper access controls are in place. Make sure to audit your site for unusual activity that could indicate exploitation attempts. You've got this! With prompt action, you can secure your website and keep it safe from attacks. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| hasthemes/shoplentor | < 3.2.6 | 3.2.6 |