CVE-2026-1714

ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action

Published Feb 18, 2026 CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Description

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all versions up to, and including, 3.3.2. This is due to the lack of validation on the 'send_to', 'product_title', 'wlmessage', and 'wlemail' parameters in the 'woolentor_suggest_price_action' AJAX endpoint. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient with full control over the subject line, message content, and sender address (via CRLF injection in the 'wlemail' parameter), effectively turning the website into a full email relay for spam or phishing campaigns.

Analysis

Technical impact

The ShopLentor WooCommerce Builder for Elementor & Gutenberg plugin is vulnerable to an unauthenticated email relay abuse in all releases up to 3.3.2 due to missing validation on the send_to, product_title, wlmessage, and wlemail parameters within the woolentor_suggest_price_action AJAX endpoint, which allows an attacker to inject CRLF sequences in wlemail to forge arbitrary From headers, control subject and body, therefore turning the WordPress site into a full email relay for spam or phishing campaigns.

Affected Systems

The flaw affects the devitemsllc:ShopLentor All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress in versions 3.3.2 and earlier, located in the class.ajax_actions.php file’s woolentor_suggest_price_action action; users on these releases should upgrade promptly.

Risk and Exploitability

With a CVSS score of 8.6 and an EPSS score less than 1%, the vulnerability is high severity yet low exploitation probability; the attack can be performed remotely without authentication by sending a crafted POST request to wp-admin/admin-ajax.php?action=woolentor_suggest_price_action, making rapid remediation critical to prevent mass email abuse.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

devitemsllc

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.3.2

No data.

Vendor Product Versions

Devitemsllc

Shoplentor – All-in-one Woocommerce Growth & Store Enhancement Plugin

Version	Status	Scheme	Platform
`[0,3.3.2]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade ShopLentor to the latest version (≥3.3.3) which removes the missing validation on the woolentor_suggest_price_action endpoint.
If an immediate update is not possible, block unauthenticated HTTP POST requests to wp-admin/admin-ajax.php?action=woolentor_suggest_price_action using a Web Application Firewall or by disabling the action in code.
Restrict or disable the site’s mail‑sending capability for unauthenticated users, or configure a mail relay that blocks spoofed sender addresses, to prevent the abused plugin from functioning as an email relay.

Generated by OpenCVE AI on April 15, 2026 at 17:08 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.723% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L170
https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L189
https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L192
https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L170
https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L189
https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L192
https://plugins.trac.wordpress.org/changeset/3461704/woolentor-addons/trunk/classes/class.ajax_actions.php?contextall=1
https://www.wordfence.com/threat-intel/vulnerabilities/id/cf326914-6a38-4984-a2a7-66e05f41a96b?source=cve

History

Feb 18, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 18, 2026 11:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Devitemsllc Devitemsllc shoplentor – All-in-one Woocommerce Growth & Store Enhancement Plugin Wordpress Wordpress wordpress
Vendors & Products		Devitemsllc Devitemsllc shoplentor – All-in-one Woocommerce Growth & Store Enhancement Plugin Wordpress Wordpress wordpress

Feb 18, 2026 5:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all versions up to, and including, 3.3.2. This is due to the lack of validation on the 'send_to', 'product_title', 'wlmessage', and 'wlemail' parameters in the 'woolentor_suggest_price_action' AJAX endpoint. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient with full control over the subject line, message content, and sender address (via CRLF injection in the 'wlemail' parameter), effectively turning the website into a full email relay for spam or phishing campaigns.
Title		ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action
Weaknesses		CWE-93
References		https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L170 https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L189 https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L192 https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L170 https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L189 https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L192 https://plugins.trac.wordpress.org/changeset/3461704/woolentor-addons/trunk/classes/class.ajax_actions.php?contextall=1 https://www.wordfence.com/threat-intel/vulnerabilities/id/cf326914-6a38-4984-a2a7-66e05f41a96b?source=cve
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N'}`