CVE-2026-6020 Arbitrary Function Execution in ShopLentor Plugin

The ShopLentor plugin for WordPress, specifically in versions 3.3.7 and earlier, contains a critical security flaw identified as CVE-2026-6020. The vulnerability resides in the woolentoropt/v1/custom-action REST API endpoint. The underlying handle_action() method fails to validate user-supplied input, directly passing the callback parameter to the PHP call_user_func() function without an allowlist.

This vulnerability allows an attacker who has already obtained Administrator-level privileges on a WordPress site to execute arbitrary PHP functions on the underlying web server. By providing a malicious callback value, an authenticated attacker can achieve remote code execution, which could lead to full site compromise, exfiltration of database contents, or lateral movement within the hosting environment. Defenders should focus on auditing REST API requests for calls to this endpoint that involve sensitive PHP functions or unexpected payloads.

Impact

Successful exploitation allows an authenticated administrator to execute arbitrary code on the server hosting the WordPress instance. This risk level is high given that it grants an attacker complete control over the application environment. Victims are limited to WordPress instances running the vulnerable ShopLentor plugin (version 3.3.7 or lower), representing a targeted set of e-commerce installations.

Recommendation

• Update the ShopLentor plugin to the latest version immediately to patch CVE-2026-6020.
• Audit administrative access logs for the site to identify unauthorized or suspicious user account activity.
• Implement the Sigma rule below to monitor for abuse of the vulnerable API endpoint within web server access logs.
• Restrict access to the WordPress /wp-json/ REST API namespace for non-essential administrative accounts if possible.