CVE-2026-16811: ShopLentor WordPress Plugin SQLi Vulnerability

CVE-2026-16811 Overview

CVE-2026-16811 is a time-based SQL injection vulnerability in the ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress. The flaw affects all versions up to and including 3.4.5. The vulnerability resides in the orderby parameter, which is passed into an SQL query without sufficient escaping or query preparation. Authenticated attackers with administrator-level privileges can append SQL statements to the existing query and extract data from the WordPress database. The issue is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Administrator-level attackers can inject time-based SQL payloads through the orderby parameter to exfiltrate sensitive database contents, including WordPress user credentials and abandoned cart records.

Affected Products

ShopLentor (formerly WooLentor) – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress
All plugin versions up to and including 3.4.5
Abandoned Cart module (Cart_Data.php, DB_Handler.php)

Discovery Timeline

2026-07-28 - CVE-2026-16811 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-16811

Vulnerability Analysis

The ShopLentor plugin's abandoned cart module constructs SQL queries that incorporate the user-supplied orderby parameter directly into the query string. Because the parameter is not escaped and the query is not parameterized with $wpdb->prepare(), attacker-controlled input becomes part of the executable SQL. An authenticated user with administrator privileges can supply crafted orderby values that inject additional SQL clauses. Time-based blind techniques such as SLEEP() allow the attacker to infer query results one bit at a time by measuring server response delays. The vulnerable code paths are located in the abandoned cart module's Cart_Data class and DB_Handler class.

Root Cause

The root cause is a failure to sanitize the orderby parameter and a failure to use prepared statements when constructing the underlying SQL query. WordPress provides $wpdb->prepare() and allow-list validation patterns for ORDER BY clauses, but ShopLentor's abandoned cart handler does neither before concatenating the value into the query.

Attack Vector

Exploitation requires an authenticated session with administrator-level privileges. The attacker sends a request to the abandoned cart API endpoint with a manipulated orderby value containing SQL syntax and a time-delay function. The database evaluates the injected clause, producing observable delays that leak information. See the Wordfence Vulnerability Analysis and the WordPress Plugin Change Set for the corrective diff. No verified proof-of-concept code is publicly available at this time.

Detection Methods for CVE-2026-16811

Indicators of Compromise

Abandoned cart API requests where the orderby query parameter contains SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or comment markers (--, #, /*).
Unusually long response times on WordPress admin AJAX or REST endpoints associated with the ShopLentor abandoned cart module.
Repeated admin-authenticated requests to the abandoned cart endpoints with varying orderby values, indicating iterative blind extraction.

Detection Strategies

Inspect web server and PHP-FPM access logs for administrator sessions issuing requests containing encoded SQL syntax in the orderby parameter.
Enable MySQL general query logging in test environments to observe malformed ORDER BY clauses produced by the plugin.
Deploy a web application firewall rule that flags SQL metacharacters in the orderby parameter for ShopLentor request paths.

Monitoring Recommendations

Monitor administrator account activity for unexpected API calls to the abandoned cart module.
Alert on database response-time anomalies correlated with WordPress admin requests.
Track plugin version inventory across WordPress deployments to identify hosts running ShopLentor 3.4.5 or earlier.

How to Mitigate CVE-2026-16811

Immediate Actions Required

Update the ShopLentor plugin to the version published after the 3.4.5 change set that addresses the injection.
Review recent administrator activity logs for suspicious abandoned cart API calls.
Rotate credentials for any administrator accounts that may have been compromised, since exploitation requires admin access.

Patch Information

The vendor has published a corrective change set that adds proper escaping and query preparation in the abandoned cart module. WordPress site operators should apply the update through the plugin management console or by deploying the fixed release from the official plugin repository.

Workarounds

Temporarily deactivate the ShopLentor abandoned cart module if the update cannot be applied immediately.
Restrict administrator account access using multi-factor authentication and least-privilege principles.
Apply a WAF rule blocking SQL syntax and time-delay functions in the orderby parameter for /wp-json/ and admin-ajax.php endpoints associated with ShopLentor.

bash

# Example WAF rule (ModSecurity) blocking SQL syntax in the orderby parameter
SecRule ARGS:orderby "@rx (?i)(sleep|benchmark|union|select|--|/\*)" \
    "id:1026811,phase:2,deny,status:403,\
     msg:'CVE-2026-16811 ShopLentor orderby SQLi attempt'"