Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-16797: ShopLentor <= 3.4.5: Sensitive Info Exposure via Plugin Settings

CVE-2026-16797 · published 3 months ago

Summary

The ShopLentor plugin for WordPress has a security flaw that allows attackers with contributor-level access to read sensitive information. This information includes internal plugin settings and data from other plugins. To fix this issue, update the ShopLentor plugin to version 3.4.6 or later.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
devitemsllc	shoplentor – all-in-one woocommerce growth & store enhancement plugin	<= 3.4.5

Original advisory text

ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to read arbitrary wp_options rows — including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records — whose values are stored as arrays-of-arrays containing 'title' keys, enabling cross-plugin data leakage.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-639Authorization Bypass Through User-Controlled Key

Timeline

Published28 Jul 2026

Updated4 Nov 2026

First seen28 Jul 2026

Sources

CVE-2026-16797 · NVD

CVE-2026-16797 · MITRE

Track software like this

Free during beta