CVE-2026-6020 Overview
CVE-2026-6020 is an arbitrary function execution vulnerability in the ShopLentor plugin for WordPress. The flaw affects all versions up to and including 3.3.7. The woolentoropt/v1/custom-action REST API endpoint passes user-supplied input directly to PHP's call_user_func() without validating callbacks against an allowlist. Authenticated attackers with Administrator-level access can invoke arbitrary PHP callables through the callback parameter. The issue is categorized under CWE-470: Use of Externally-Controlled Input to Select Classes or Code.
Critical Impact
Administrator-level attackers can execute arbitrary PHP functions on affected WordPress sites, leading to full compromise of confidentiality, integrity, and availability.
Affected Products
- ShopLentor plugin for WordPress (also known as WooLentor)
- All versions up to and including 3.3.7
- WordPress installations with the plugin activated
Discovery Timeline
- 2026-08-05 - CVE-2026-6020 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-6020
Vulnerability Analysis
The ShopLentor plugin registers a REST API route at woolentoropt/v1/custom-action. The handle_action() method in Custom_Actions.php accepts a callback parameter from the request body and forwards it directly to PHP's call_user_func(). Because the plugin does not validate the callable against an allowlist of permitted functions, any PHP function name or callable reference supplied by the attacker is executed within the WordPress process.
An attacker with Administrator privileges can invoke sensitive PHP functions such as file_put_contents, system, or plugin-specific administrative helpers. This transforms a legitimate administrative capability into arbitrary code execution against the underlying PHP runtime.
Root Cause
The root cause is missing input validation on the callback parameter. The Custom_Actions.php source shows that user-controlled input reaches call_user_func() without a whitelist check. This is a classic [CWE-470] pattern where externally controlled input selects the code to execute.
Attack Vector
Exploitation requires an authenticated session with Administrator-level privileges. The attacker sends a crafted HTTP request to the woolentoropt/v1/custom-action REST endpoint with a chosen callback value and any required arguments. The endpoint invokes the callable, and the return value or side effects reflect the attacker's chosen function. Refer to the Wordfence Vulnerability Analysis for additional technical details.
Detection Methods for CVE-2026-6020
Indicators of Compromise
- Unexpected POST requests to /wp-json/woolentoropt/v1/custom-action containing a callback parameter with non-plugin function names.
- New or modified PHP files in the WordPress webroot following requests to the affected endpoint.
- Outbound network connections initiated by the PHP-FPM or webserver process shortly after administrative REST API activity.
- WordPress audit log entries showing REST API calls from Administrator accounts to woolentoropt/v1/custom-action outside routine plugin usage.
Detection Strategies
- Inspect webserver access logs for requests to woolentoropt/v1/custom-action and extract callback values that do not match legitimate ShopLentor callables.
- Correlate REST API access with subsequent filesystem modifications under wp-content/ and wp-includes/.
- Alert on Administrator sessions issuing REST API traffic from IP addresses that deviate from historical baselines.
Monitoring Recommendations
- Enable WordPress activity logging plugins to capture REST API invocations by Administrator accounts.
- Forward webserver and PHP error logs to a centralized SIEM for correlation with endpoint telemetry.
- Monitor for anomalous child processes spawned by the webserver, such as sh, bash, or curl invocations following REST calls.
How to Mitigate CVE-2026-6020
Immediate Actions Required
- Update the ShopLentor plugin to a version later than 3.3.7 that includes the fix referenced in the WordPress Changeset Update.
- Audit Administrator accounts and remove unused or dormant privileged users.
- Rotate credentials for all Administrator accounts and enforce multi-factor authentication.
- Review the site for indicators of prior exploitation, including modified plugin files and unexpected scheduled tasks.
Patch Information
The ShopLentor development team addressed the vulnerability in the plugin trunk. The corrective changeset restricts the callback handling in Custom_Actions.php. Administrators should upgrade to the latest available ShopLentor release from the WordPress plugin repository.
Workarounds
- Deactivate and remove the ShopLentor plugin until an upgrade to a patched version can be applied.
- Restrict access to the /wp-json/woolentoropt/v1/custom-action endpoint at the webserver or WAF layer.
- Limit Administrator role assignment to a minimum set of trusted accounts and audit their activity regularly.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
