ShopLentor allows an unauthenticated attacker to invoke the load_template function with a user supplied file path, resulting in the inclusion and execution of arbitrary local PHP files on the WordPress host. This flaw can be used to bypass access controls, read sensitive data, or run malicious code with the privileges of the web application, effectively giving the attacker full control over the affected server.

The vulnerability affects the devitemsllc ShopLentor All‑in‑One WooCommerce Growth & Store Enhancement Plugin, specifically all releases up to and including version 3.2.5. Users of earlier releases should verify the installed version against the product’s changelog for fixes.

With a CVSS score of 9.8 the flaw is considered a critical remote‑execution risk. The EPSS score of <1% indicates a low overall exploitation probability at this time, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a simple HTTP request to the plugin’s load_template endpoint, which does not require authentication.