CVE-2024-4566: ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-21 · updated 2026-06-17
Weakness: CWE-862

Description

The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 2.8.8. This makes it possible for authenticated attackers, with contributor-level access and above, to set arbitrary WordPress options to "true". NOTE: This vulnerability can be exploited by attackers with subscriber- or customer-level access and above if (1) the WooCommerce plugin is deactivated or (2) access to the default WordPress admin dashboard is explicitly enabled for authenticated users.

Affected products

devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: before 2.8.9 — fixed in 2.8.9

How to fix

Upgrade to a fixed version: devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin 2.8.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-4566 or the next vulnerability affects your stack