The ShopLentor plugin for WordPress is vulnerable because the handle_action() method forwards user input directly to call_user_func() without an allow‑list, thereby allowing an authenticated administrator to specify any PHP callable through the 'callback' parameter. This flaw can be exploited to run arbitrary code with the privileges of the WordPress installation, potentially leading to full server compromise. The weakness corresponds to CWE‑470.

All installations of devitemsllc:ShopLentor – All‑in‑One WooCommerce Growth & Store Enhancement Plugin up to and including version 3.3.7 are affected. The vulnerability exists in the woolentoropt/v1/custom-action REST API endpoint used by the plugin.

The CVSS score is 7.2, indicating a high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access with Administrator privilege and hinges on the misuse of a REST API endpoint; the lack of manual input validation makes exploitation straightforward for those with the required role. Based on the description, it is inferred that the attack vector is via the woolentoropt/v1/custom-action endpoint and the attacker must be able to send crafted REST requests to the site.