https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:14:19 +0000 https://cve.radiocsirt.org/vuln/cve-2026-6020 <p><strong>Affected:</strong> devitemsllc ShopLentor – All-in-One WooCommerce Growth &amp; Store Enhancement Plugin</p> <p>The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the &#39;callback&#39; parameter.</p> <p><strong>Affected:</strong> devitemsllc ShopLentor – All-in-One WooCommerce Growth &amp; Store Enhancement Plugin</p> <p>The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the &#39;callback&#39; parameter.</p> https://cve.radiocsirt.org/vuln/cve-2026-6020