CVE-2026-1714: ShopLentor WordPress Email Relay Vulnerability

CVE-2026-1714 Overview

CVE-2026-1714 affects the ShopLentor WooCommerce Builder for Elementor & Gutenberg plugin for WordPress in all versions up to and including 3.3.2. The vulnerability allows unauthenticated attackers to abuse the woolentor_suggest_price_action AJAX endpoint as an open email relay. Missing input validation on the send_to, product_title, wlmessage, and wlemail parameters lets attackers control the recipient, subject, body, and sender of outbound emails. Carriage Return Line Feed (CRLF) injection in the wlemail parameter enables header manipulation, classifying the flaw under CWE-93: Improper Neutralization of CRLF Sequences.

Critical Impact
Unauthenticated attackers can weaponize affected WordPress sites as full-featured spam and phishing relays, damaging sender reputation and enabling brand impersonation.

Affected Products

ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules plugin for WordPress
All versions up to and including 3.3.2
WordPress installations using the woolentor-addons package

Discovery Timeline

2026-02-18 - CVE-2026-1714 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1714

Vulnerability Analysis

The flaw resides in the woolentor_suggest_price_action AJAX handler defined in classes/class.ajax_actions.php. This endpoint implements a "suggest price" feature that emails product price suggestions to a designated recipient. The handler accepts four user-controlled parameters without sanitization or whitelist validation: send_to (recipient address), product_title (used in the subject line), wlmessage (email body), and wlemail (sender address used in the From header).

Because the endpoint is reachable without authentication and lacks nonce or origin verification, any remote actor can issue crafted POST requests to trigger outbound mail. The site's mail server signs and dispatches the messages, lending legitimacy to the attacker's content.

Root Cause

The handler passes attacker-supplied input directly into wp_mail() arguments without filtering line terminators or validating recipient and sender values. The wlemail parameter is concatenated into mail headers, so unescaped \r\n sequences allow injection of additional headers such as Bcc, Cc, or replacement Subject fields. The absence of capability checks (current_user_can) and nonce verification (check_ajax_referer) compounds the issue by removing all access barriers.

Attack Vector

An attacker sends an unauthenticated POST request to /wp-admin/admin-ajax.php with action=woolentor_suggest_price_action and crafted parameter values. The wlemail field carries CRLF sequences followed by injected headers and an alternate message body, while send_to defines the target inbox. The site processes the request and delivers the attacker's message from a trusted domain. Repeating this pattern across a victim list converts the WordPress instance into a bulk mailer for phishing or spam. Refer to the Wordfence Vulnerability Report and the vulnerable code at line 170 for technical details.

Detection Methods for CVE-2026-1714

Indicators of Compromise

POST requests to admin-ajax.php containing action=woolentor_suggest_price_action from unauthenticated sessions or unusual IP ranges.
Outbound SMTP volume spikes from the WordPress host, particularly to recipients unrelated to the site's customer base.
Mail server logs showing From addresses that do not match the site's configured sender identity.
Bounce messages or abuse complaints referencing subjects derived from attacker-controlled product_title values.

Detection Strategies

Inspect web server access logs for repeated requests to /wp-admin/admin-ajax.php carrying the woolentor_suggest_price_action action parameter.
Alert on payloads containing URL-encoded CRLF sequences (%0d%0a) in wlemail, send_to, or related fields.
Correlate AJAX request rates with outbound mail queue growth to identify relay abuse in progress.

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule that blocks unauthenticated calls to the vulnerable AJAX action.
Forward WordPress and mail transfer agent (MTA) logs to a Security Information and Event Management (SIEM) platform for unified correlation.
Track sender reputation metrics and DMARC reports for unexpected mail flow originating from the WordPress domain.

How to Mitigate CVE-2026-1714

Immediate Actions Required

Upgrade the ShopLentor plugin to a version newer than 3.3.2 that includes the fix from changeset 3461704.
Audit mail logs from the disclosure window forward for unauthorized outbound messages and notify recipients if abuse is confirmed.
Rotate any SMTP credentials and review SPF, DKIM, and DMARC alignment to limit downstream damage.

Patch Information

The maintainer addressed the issue in the woolentor-addons repository via changeset 3461704, which introduces input validation and header sanitization for the woolentor_suggest_price_action handler. Administrators should apply the update through the WordPress plugin dashboard or via WP-CLI. Confirm the installed version is greater than 3.3.2 after upgrade.

Workarounds

Deactivate the ShopLentor plugin until the patched version is deployed if immediate upgrade is not possible.
Add a WAF or reverse proxy rule that drops requests where action=woolentor_suggest_price_action is present without a valid authenticated session.
Restrict outbound SMTP on the WordPress host to known mail relays and apply per-host rate limits to contain abuse.

bash

# Example WAF rule (ModSecurity) blocking unauthenticated abuse of the vulnerable AJAX action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1002026,msg:'Block CVE-2026-1714 ShopLentor email relay abuse'"
    SecRule ARGS:action "@streq woolentor_suggest_price_action" \
        "chain"
        SecRule ARGS:wlemail "@rx (\r|\n|%0d|%0a)" "t:lowercase"