CVE-2025-12493

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12493", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-29T20:10:08.366Z", "datePublished": "2025-11-04T11:19:27.403Z", "dateUpdated": "2026-04-08T16:36:30.320Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:30.320Z"}, "affected": [{"vendor": "devitemsllc", "product": "ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +21 Modules \u2013 All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "title": "ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12bb4bb9-e908-43ad-8fb1-59418580f5e1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/includes/addons/product-grid/base/class.product-grid-base.php#L378"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L241"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L213"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L42"}, {"url": "https://plugins.trac.wordpress.org/changeset/3388234/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "timeline": [{"time": "2025-10-29T20:27:08.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-03T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T19:34:24.746344Z", "id": "CVE-2025-12493", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T20:13:56.143Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-04T19:34:24.746344Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T19:38:46.952Z"}}], "cna": {"title": "ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'", "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "devitemsllc", "product": "ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-29T20:27:08.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-03T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12bb4bb9-e908-43ad-8fb1-59418580f5e1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/includes/addons/product-grid/base/class.product-grid-base.php#L378"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L241"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L213"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L42"}, {"url": "https://plugins.trac.wordpress.org/changeset/3388234/"}], "descriptions": [{"lang": "en", "value": "The ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +21 Modules \u2013 All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:30.320Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12493", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:36:30.320Z", "dateReserved": "2025-10-29T20:10:08.366Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-04T11:19:27.403Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin", "vendor": "devitemsllc", "versions": [{"lessThanOrEqual": "3.2.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hasthemes:shoplentor:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "933798AC-CE46-4823-80D4-4E91DA26FCA8", "versionEndExcluding": "3.2.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +21 Modules \u2013 All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}, {"lang": "es", "value": "El plugin ShopLentor - WooCommerce Builder for Elementor & Gutenberg +21 Modules - All in One Solution (anteriormente WooLentor) para WordPress es vulnerable a la inclusi\u00f3n local de ficheros en todas las versiones hasta la 3.2.5, inclusive, a trav\u00e9s de la funci\u00f3n 'load_template'. Esto hace posible que atacantes no autenticados incluyan y ejecuten ficheros .PHP arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede usarse para eludir controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde se pueden subir e incluir tipos de ficheros .PHP."}], "id": "CVE-2025-12493", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12493", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-04T19:34:24.746344Z", "version": "2.0.3"}}]}, "published": "2025-11-04T12:15:36.957", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L213"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L241"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L42"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/includes/addons/product-grid/base/class.product-grid-base.php#L378"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/changeset/3388234/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12bb4bb9-e908-43ad-8fb1-59418580f5e1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:44:09.962762+00:00", "value": {"mitigation_remediation": ["Upgrade ShopLentor to a version newer than 3.2.5 if one is available. The vendor\u2019s release notes indicate that subsequent releases patch the local file inclusion flaw.", "If an immediate upgrade is not feasible, disable or remove the load_template functionality by deactivating the plugin or manually editing the plugin code to block the inclusion of arbitrary files.", "Configure the web server or a web application firewall to block unauthenticated requests to the load_template endpoint and to prevent execution of PHP files in plugin directories."], "summary": {"action": "Immediate Patch", "impact": "Server\u2011side code execution via unauthenticated local file inclusion"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the devitemsllc ShopLentor All\u2011in\u2011One WooCommerce Growth & Store Enhancement Plugin, specifically all releases up to and including version 3.2.5. Users of earlier releases should verify the installed version against the product\u2019s changelog for fixes.", "description_and_impact": "ShopLentor allows an unauthenticated attacker to invoke the load_template function with a user supplied file path, resulting in the inclusion and execution of arbitrary local PHP files on the WordPress host. This flaw can be used to bypass access controls, read sensitive data, or run malicious code with the privileges of the web application, effectively giving the attacker full control over the affected server.", "risk_and_exploitability": "With a CVSS score of 9.8 the flaw is considered a critical remote\u2011execution risk. The EPSS score of <1% indicates a low overall exploitation probability at this time, and the vulnerability is not listed in CISA\u2019s KEV catalog. The likely attack vector is a simple HTTP request to the plugin\u2019s load_template endpoint, which does not require authentication."}}}}, "created": "2025-11-04T16:32:58.856756+00:00", "updated": "2026-04-22T16:45:21.465137+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}