CVE-2025-12493

ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'

View on CVE.org
Published Nov 4, 2025 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Analysis

AI-generated

Technical impact

ShopLentor allows an unauthenticated attacker to invoke the load_template function with a user supplied file path, resulting in the inclusion and execution of arbitrary local PHP files on the WordPress host. This flaw can be used to bypass access controls, read sensitive data, or run malicious code with the privileges of the web application, effectively giving the attacker full control over the affected server.

Affected Systems

The vulnerability affects the devitemsllc ShopLentor All‑in‑One WooCommerce Growth & Store Enhancement Plugin, specifically all releases up to and including version 3.2.5. Users of earlier releases should verify the installed version against the product’s changelog for fixes.

Risk and Exploitability

With a CVSS score of 9.8 the flaw is considered a critical remote‑execution risk. The EPSS score of <1% indicates a low overall exploitation probability at this time, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a simple HTTP request to the plugin’s load_template endpoint, which does not require authentication.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ShopLentor to a version newer than 3.2.5 if one is available. The vendor’s release notes indicate that subsequent releases patch the local file inclusion flaw.
  • If an immediate upgrade is not feasible, disable or remove the load_template functionality by deactivating the plugin or manually editing the plugin code to block the inclusion of arbitrary files.
  • Configure the web server or a web application firewall to block unauthenticated requests to the load_template endpoint and to prevent execution of PHP files in plugin directories.

Generated by OpenCVE AI on April 22, 2026 at 16:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Hasthemes
Hasthemes shoplentor
CPEs cpe:2.3:a:hasthemes:shoplentor:*:*:*:*:*:wordpress:*:*
Vendors & Products Hasthemes
Hasthemes shoplentor
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Title ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Apr 8, 2026, 4:36 PM
Reserved
Oct 29, 2025, 8:10 PM

View source JSON

Updated
Nov 4, 2025, 7:38 PM

JSON

Status
Analyzed
Published
Nov 4, 2025, 12:15 PM
Modified
Oct 18, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 22, 2026, 4:45 PM

JSON