Is CVE-2026-6020 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-6020?

CVE-2026-6020 has a CVSS v3 severity of HIGH (7.2).

Back

CVE-2026-6020

Description

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the 'callback' parameter.