CVE-2026-16797: ShopLentor IDOR Information Disclosure

CVE-2026-16797 Overview

CVE-2026-16797 is an Insecure Direct Object Reference (IDOR) vulnerability in the ShopLentor WordPress plugin, also tracked as woolentor-addons. The flaw affects all versions up to and including 3.4.5 and stems from missing validation on the optionSection parameter. Authenticated users holding contributor-level access or above can read arbitrary wp_options rows whose values are stored as arrays-of-arrays containing title keys. Retrievable data includes internal plugin news feed entries, WooCommerce block pattern transients, and third-party configuration records, enabling cross-plugin data leakage on affected sites.

Critical Impact
Authenticated contributors can read arbitrary WordPress option rows, exposing configuration data written by other plugins on the same site.

Affected Products

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (woolentor-addons) for WordPress
All versions through 3.4.5
WordPress sites using the ShopLentor blocks API (woolentor-blocks)

Discovery Timeline

2026-07-28 - CVE-2026-16797 published to the National Vulnerability Database
2026-07-28 - Last updated in the NVD database

Technical Details for CVE-2026-16797

Vulnerability Analysis

The vulnerability is classified as an Insecure Direct Object Reference [CWE-639]. The ShopLentor blocks API accepts an optionSection parameter from the client and passes it into option-lookup logic without validating that the requested key belongs to a permitted set. As a result, the plugin returns option data whose access should be restricted to administrators or the owning plugin. Attackers must authenticate with contributor-level privileges, but they do not need administrative rights, elevated roles, or user interaction beyond a standard API call.

Root Cause

The root cause is missing authorization on a user-controlled key. The affected API endpoint in woolentor-blocks/includes/classes/Api/Api.php and its supporting helpers in helper-functions.php treat the optionSection value as trusted input. The handler queries wp_options for records whose stored value is an array of arrays containing title keys, then returns matching entries to the requester. Because there is no allow-list of option names, the endpoint discloses unrelated option rows written by the plugin itself, by WooCommerce, and by unrelated third-party plugins that happen to share the same data shape.

Attack Vector

Exploitation requires authenticated access as a contributor or higher and network reachability to the WordPress REST API. An attacker enumerates or guesses option keys, submits them via the optionSection parameter, and parses the response for sensitive fields. Refer to the Wordfence Vulnerability Analysis and the plugin source in the ShopLentor Api.php reference for the vulnerable code paths. No public proof-of-concept exploit or exploitation activity has been reported.

Detection Methods for CVE-2026-16797

Indicators of Compromise

REST API requests to ShopLentor blocks endpoints containing the optionSection query parameter originating from non-administrative accounts.
Response payloads to contributor sessions that include option names outside the ShopLentor namespace, such as WooCommerce transients or unrelated plugin configuration keys.
Bursts of sequential or dictionary-style optionSection values from a single authenticated session, indicating enumeration.

Detection Strategies

Enable REST API request logging in WordPress and inspect calls into the woolentor-blocks route for unexpected optionSection values.
Correlate contributor and author session activity with reads of sensitive option keys that these roles would not normally access.
Review web server logs for high-volume requests to the ShopLentor blocks API from the same authenticated user within short time windows.

Monitoring Recommendations

Alert on any authenticated REST API call from non-administrative roles that references the optionSection parameter.
Track newly created contributor and author accounts, especially those that immediately begin issuing REST API traffic.
Retain WordPress and reverse-proxy logs long enough to reconstruct enumeration sequences against the affected endpoint.

How to Mitigate CVE-2026-16797

Immediate Actions Required

Update the ShopLentor plugin to a release later than 3.4.5 that includes the fix committed in the ShopLentor changeset 3623166.
Audit contributor, author, and higher-privilege accounts and remove any that are unused or unauthorized.
Rotate secrets stored in wp_options by third-party plugins if contributor accounts on the site cannot be fully accounted for.

Patch Information

The vendor addressed the issue in the ShopLentor code base following version 3.4.5. The upstream fix is visible in the ShopLentor changeset 3623166, which adjusts the affected API handlers in woolentor-blocks/includes/classes/Api/Api.php and the helper functions in woolentor-blocks/includes/helper-functions.php. Administrators should install the latest ShopLentor release from the WordPress plugin repository and confirm the running version in the WordPress dashboard.

Workarounds

Deactivate the ShopLentor plugin until the patched version is applied if contributor accounts exist on the site.
Restrict access to the WordPress REST API for contributor and author roles using a security plugin or web application firewall rule.
Temporarily block requests containing the optionSection parameter to the woolentor-blocks API route at the reverse proxy.

bash

# Example nginx rule to block the vulnerable parameter until patching
location ~* /wp-json/woolentor-blocks/ {
    if ($arg_optionSection) {
        return 403;
    }
}