CVE-2025-3775: Hasthemes Shoplentor SSRF Vulnerability

CVE-2025-3775 Overview

CVE-2025-3775 is a Server-Side Request Forgery (SSRF) vulnerability affecting the ShopLentor WordPress plugin, formerly known as WooLentor. The flaw resides in the woolentor_template_proxy function and impacts all versions up to and including 3.1.2. Unauthenticated attackers can force the affected WordPress instance to issue arbitrary HTTP requests to attacker-controlled or internal destinations. This behavior enables reconnaissance and interaction with internal services that are otherwise unreachable from the public internet. The weakness is tracked as CWE-918.

Critical Impact
Unauthenticated attackers can pivot through vulnerable WordPress sites to query or modify internal services, exposing metadata endpoints, intranet applications, and cloud provider APIs.

Affected Products

HasThemes ShopLentor (formerly WooLentor) plugin for WordPress, all versions through 3.1.2
WordPress sites running the WooCommerce Builder for Elementor and Gutenberg modules bundled in ShopLentor
Any WordPress installation exposing the woolentor_template_proxy endpoint to unauthenticated traffic

Discovery Timeline

2025-04-25 - CVE-2025-3775 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3775

Vulnerability Analysis

The ShopLentor plugin exposes the woolentor_template_proxy function to handle template preview requests. The function accepts a user-supplied URL parameter and issues an outbound HTTP request from the WordPress server without adequate validation of the destination host or scheme. Because the endpoint does not enforce authentication, any remote actor can invoke it and receive or influence the response.

SSRF attacks against WordPress plugins are commonly used to reach cloud metadata services such as http://169.254.169.254/, internal admin panels, or unauthenticated services bound to loopback interfaces. The confidentiality and integrity impact is limited but real: attackers can read data returned by internal endpoints and, in some configurations, trigger state changes on services that trust local traffic.

Root Cause

The woolentor_template_proxy handler treats the incoming URL parameter as trusted input. It performs no allowlist validation of destination hosts, does not restrict URL schemes to http and https for external assets, and does not block private IP ranges, link-local addresses, or DNS names that resolve to internal hosts. Combined with the absence of a capability check or nonce verification, this creates a fully unauthenticated SSRF primitive. Refer to the WordPress WooLentor code reference for the affected source location.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a crafted request to the AJAX or admin endpoint that dispatches to woolentor_template_proxy, supplying a URL parameter pointing at an internal resource. The WordPress server performs the request server-side and returns the fetched content in the response. Additional technical detail is available in the Wordfence vulnerability report.

// No verified public exploit code is available for CVE-2025-3775.
// The vulnerability is triggered by supplying an attacker-controlled URL
// to the unauthenticated woolentor_template_proxy handler, which then
// issues a server-side HTTP request to the specified destination.

Detection Methods for CVE-2025-3775

Indicators of Compromise

Web server access logs containing requests to admin-ajax.php or plugin endpoints invoking the woolentor_template_proxy action from unauthenticated sessions
Outbound HTTP requests from the WordPress host to private IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 169.254.169.254
Unexpected User-Agent strings originating from PHP or WordPress HTTP APIs targeting internal services

Detection Strategies

Inspect WordPress request logs for the woolentor_template_proxy action parameter and correlate with the source IP and URL argument submitted
Alert on any outbound connection from web tier hosts to cloud metadata endpoints or RFC1918 destinations that are not part of normal application traffic
Deploy WAF rules that flag requests carrying URL parameters resolving to internal or loopback addresses

Monitoring Recommendations

Enable verbose logging on the WordPress application layer and forward logs to a centralized analytics platform for retention and correlation
Monitor egress traffic from WordPress hosts and enforce network segmentation between the web tier and sensitive internal services
Track plugin version inventory across WordPress fleets and alert when ShopLentor versions at or below 3.1.2 remain installed

How to Mitigate CVE-2025-3775

Immediate Actions Required

Update the ShopLentor plugin to a release later than 3.1.2 that addresses the woolentor_template_proxy SSRF flaw
Audit WordPress sites for the presence of the vulnerable plugin and prioritize public-facing installations for immediate patching
Restrict outbound network access from WordPress hosts so that they cannot reach cloud metadata services or internal management interfaces

Patch Information

HasThemes has released updates to the ShopLentor plugin. Administrators should upgrade to the latest available version from the WordPress plugin repository. Confirm the fix by reviewing the plugin changelog and verifying that the woolentor_template_proxy handler enforces destination validation. Consult the Wordfence advisory for the fixed version reference.

Workarounds

Disable and remove the ShopLentor plugin until an updated version can be deployed
Block unauthenticated access to admin-ajax.php actions associated with woolentor_template_proxy at the web application firewall
Apply egress filtering to prevent WordPress hosts from reaching link-local address 169.254.169.254 and RFC1918 ranges that are not required for application operation

bash

# Example egress restriction using iptables to block access to the
# cloud metadata service from the WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Example nginx rule to block requests targeting the vulnerable action
if ($arg_action = "woolentor_template_proxy") {
    return 403;
}