CVE-2024-4566highCWE-862

CVE-2024-4566: fallo de gravedad alta en devitemsllc ShopLentor – All-in-One…

ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.4%
The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 2.8.8. This makes it possible for authenticated attackers, with contributor-level access and above, to set arbitrary WordPress options to "true". NOTE: This vulnerability can be exploited by attackers with subscriber- or customer-level access and above if (1) the WooCommerce plugin is deactivated or (2) access to the default WordPress admin dashboard is explicitly enabled for authenticated users.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Productos afectados
devitemsllc · ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
CVEs relacionadas — devitemsllc ShopLentor – All-in-One…

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-12493CRITICALShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'EPSS 0.8%CVE-2026-6020HIGHShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST APIEPSS 0.8%CVE-2026-1714HIGHShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX ActionEPSS 0.7%CVE-2023-6327MEDIUMShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_productsEPSS 0.7%CVE-2024-1960MEDIUMShopLentor <= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner LinkEPSS 0.5%CVE-2024-2868MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product LayoutEPSS 0.5%