CVE-2026-6020

The ShopLentor plugin for WordPress is affected by an authentication-restricted arbitrary function execution vulnerability. All versions up to 3.3.7 expose the woolentoropt/v1/custom-action REST endpoint; the handle_action() method passes user-supplied input directly to call_user_func() without a...