https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T03:17:21.583034+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-348549 EUVD-2026-348549 2026-10-06T03:17:21.636827+00:00 EUVD-2026-348549 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6020 fkie_cve-2026-6020 2026-10-06T03:17:21.636865+00:00

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the 'callback' parameter.

 https://cve.radiocsirt.org/vuln/ghsa-m4f6-5759-q864 GHSA-m4f6-5759-q864 2026-10-06T03:17:21.636901+00:00

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the 'callback' parameter.