Log in Start free

Vulnerability · Published Feb 18, 2026 · Assigned by Wordfence

CVE-2026-1714ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action

High 8.6

In plain English

A high-severity security flaw in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin from devitemsllc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.7%top 45.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all versions up to, and including, 3.3.2. This is due to the lack of validation on the 'send_to', 'product_title', 'wlmessage', and 'wlemail' parameters in the 'woolentor_suggest_price_action' AJAX endpoint. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient with full control over the subject line, message content, and sender address (via CRLF injection in the 'wlemail' parameter), effectively turning the website into a full email relay for spam or phishing campaigns.

Affected products (as reported)

VendorProductVersions
devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin 0 – through 3.3.2

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References