The ShopLentor plugin is affected by an Insecure Direct Object Reference vulnerability that allows an authenticated user with Contributor-level or higher access to retrieve arbitrary entries from the WordPress options database. By submitting a crafted 'optionSection' parameter, the attacker can read wp_options rows that contain plugin news feed data, WooCommerce block pattern transients, and third‑party configuration records. This results in leakage of sensitive information and cross‑plugin data exposure, compromising confidentiality. The weakness maps to CWE‑639: Permission or Access Control Issues.

WordPress sites running devitemsllc:ShopLentor – All‑in‑One WooCommerce Growth & Store Enhancement Plugin version 3.4.5 or earlier are impacted. The plugin does not perform input validation on the 'optionSection' key, enabling the exploit. No other vendors or product versions were reported to be affected.

The vulnerability has a CVSS score of 4.3, indicating moderate risk, and an EPSS score of <1%, suggesting exploitation probability is very low at present. It is not listed in CISA KEV. The attack requires the attacker to possess authenticated Contributor or higher privileges, implying that it may be leveraged by compromised accounts or internal users. The likely attack vector is an authenticated, remote request to the plugin’s API endpoint with a malicious 'optionSection' value. Given the low exploitation likelihood and moderate severity, the primary trade‑off is limited to confidentiality compromise without impacting availability or integrity.