What’s Vulnerable › Vulnerabilities

CVE-2023-0232: ShopLentor < 2.5.4 - PHP Object Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-21 · updated 2026-06-17

Description

The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Object Injection.

Affected products

• devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: before 2.5.4 — fixed in 2.5.4

How to fix

Upgrade to a fixed version: devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin 2.5.4. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/2852711/woolentor-addons/trunk/includes/helper-function.php
• https://wpscan.com/vulnerability/1885a708-0e8a-4f4c-8e26-069bebe9a518
• https://plugins.trac.wordpress.org/changeset/2852711/woolentor-addons/trunk/includes/helper-function.php
• https://wpscan.com/vulnerability/1885a708-0e8a-4f4c-8e26-069bebe9a518

Get alerted when CVE-2023-0232 or the next vulnerability affects your stack