CVE-2025-3775

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3775", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-17T16:40:43.199Z", "datePublished": "2025-04-25T04:23:04.940Z", "dateUpdated": "2026-04-08T16:51:38.675Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:38.675Z"}, "affected": [{"vendor": "devitemsllc", "product": "ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +20 Modules \u2013 All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, and can be used to query and modify information from internal services."}], "title": "ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +20 Modules \u2013 All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4dfc28ec-1411-43c3-833e-a6c85a3ed767?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.1.2/includes/admin-panel/includes/classes/Admin.php#L71"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "timeline": [{"time": "2025-04-17T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-04-24T16:21:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-25T15:10:15.932569Z", "id": "CVE-2025-3775", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-25T15:10:35.126Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3775", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-25T15:10:15.932569Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-25T15:10:22.244Z"}}], "cna": {"title": "ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +20 Modules \u2013 All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "devitemsllc", "product": "ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-17T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-04-24T16:21:41.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4dfc28ec-1411-43c3-833e-a6c85a3ed767?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.1.2/includes/admin-panel/includes/classes/Admin.php#L71"}], "descriptions": [{"lang": "en", "value": "The ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +20 Modules \u2013 All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:38.675Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3775", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:51:38.675Z", "dateReserved": "2025-04-17T16:40:43.199Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-25T04:23:04.940Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin", "vendor": "devitemsllc", "versions": [{"lessThanOrEqual": "3.1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hasthemes:shoplentor:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "4A0EC553-0DE1-4E15-B41E-35C464BAA0BF", "versionEndExcluding": "3.1.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +20 Modules \u2013 All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El complemento ShopLentor \u2013 WooCommerce Builder for Elementor &amp; Gutenberg +20 Modules \u2013 All in One Solution (formerly WooLentor) para WordPress es vulnerable a Server-Side Request Forgery en todas las versiones hasta la 3.1.2 incluida, a trav\u00e9s de la funci\u00f3n woolentor_template_proxy. Esto permite a atacantes no autenticados realizar solicitudes web a ubicaciones arbitrarias desde la aplicaci\u00f3n web, lo que puede utilizarse para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2025-3775", "lastModified": "2026-06-17T09:20:38.997", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3775", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-25T15:10:15.932569Z", "version": "2.0.3"}}]}, "published": "2025-04-25T05:15:33.153", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.1.2/includes/admin-panel/includes/classes/Admin.php#L71"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4dfc28ec-1411-43c3-833e-a6c85a3ed767?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T21:08:50.729230+00:00", "value": {"mitigation_remediation": ["Upgrade the ShopLentor plugin to version 3.1.3 or later when it becomes available.", "If upgrading immediately is not possible, disable or restrict access to the woolentor_template_proxy endpoint (for example, by removing the relevant menu item or applying a path\u2011based firewall rule).", "Restrict outbound HTTP(S) traffic from the WordPress host to only approved external domains, limiting the reach of any SSRF exploitation."], "summary": {"action": "Update plugin", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The affected product is the ShopLentor \u2013 All\u2011in\u2011One WooCommerce Growth & Store Enhancement Plugin from devitemsllc. All released versions up to and including 3.1.2, which are supported on WordPress sites, are vulnerable. Sites running any of these versions are susceptible.", "description_and_impact": "The vulnerability in the ShopLentor plugin allows an unauthenticated attacker to supply an arbitrary URL to the woolentor_template_proxy function, resulting in a server\u2011side request forgery (SSRF). With this flaw an adversary can have the WordPress application issue HTTP requests to any target, including internal services, potentially exposing sensitive data or manipulating internal resources. The weakness is classified as CWE\u2011918.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild at this time, and the issue is not currently listed in the CISA KEV catalog. Because the SSRF endpoint accepts a URL parameter without authentication, the attack vector is a public URL that an attacker can control. If exploited, the attacker could harvest internal network information or perform additional actions against services that can be reached from the hosting environment."}}}}, "created": "2026-04-21T21:15:45.449310+00:00", "updated": "2026-04-21T21:15:45.449321+00:00", "vendors": []}