CVE-2026-1714

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1714", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-30T18:56:14.509Z", "datePublished": "2026-02-18T04:35:45.965Z", "dateUpdated": "2026-04-08T17:24:37.106Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:37.106Z"}, "affected": [{"vendor": "devitemsllc", "product": "ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +21 Modules \u2013 All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all versions up to, and including, 3.3.2. This is due to the lack of validation on the 'send_to', 'product_title', 'wlmessage', and 'wlemail' parameters in the 'woolentor_suggest_price_action' AJAX endpoint. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient with full control over the subject line, message content, and sender address (via CRLF injection in the 'wlemail' parameter), effectively turning the website into a full email relay for spam or phishing campaigns."}], "title": "ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf326914-6a38-4984-a2a7-66e05f41a96b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L170"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L170"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L189"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L189"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L192"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L192"}, {"url": "https://plugins.trac.wordpress.org/changeset/3461704/woolentor-addons/trunk/classes/class.ajax_actions.php?contextall=1"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')", "cweId": "CWE-93", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "baseScore": 8.6, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Teerachai Somprasong"}], "timeline": [{"time": "2026-01-30T19:11:54.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-17T16:06:59.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T12:26:32.188077Z", "id": "CVE-2026-1714", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:53:49.971Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1714", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T12:26:32.188077Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:26:33.080Z"}}], "cna": {"title": "ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action", "credits": [{"lang": "en", "type": "finder", "value": "Teerachai Somprasong"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"}}], "affected": [{"vendor": "devitemsllc", "product": "ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.3.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-30T19:11:54.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-17T16:06:59.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf326914-6a38-4984-a2a7-66e05f41a96b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L170"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L170"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L189"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L189"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L192"}, {"url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L192"}, {"url": "https://plugins.trac.wordpress.org/changeset/3461704/woolentor-addons/trunk/classes/class.ajax_actions.php?contextall=1"}], "descriptions": [{"lang": "en", "value": "The ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +21 Modules \u2013 All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all versions up to, and including, 3.3.2. This is due to the lack of validation on the 'send_to', 'product_title', 'wlmessage', and 'wlemail' parameters in the 'woolentor_suggest_price_action' AJAX endpoint. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient with full control over the subject line, message content, and sender address (via CRLF injection in the 'wlemail' parameter), effectively turning the website into a full email relay for spam or phishing campaigns."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:37.106Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1714", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:24:37.106Z", "dateReserved": "2026-01-30T18:56:14.509Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-18T04:35:45.965Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin", "vendor": "devitemsllc", "versions": [{"lessThanOrEqual": "3.3.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +21 Modules \u2013 All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all versions up to, and including, 3.3.2. This is due to the lack of validation on the 'send_to', 'product_title', 'wlmessage', and 'wlemail' parameters in the 'woolentor_suggest_price_action' AJAX endpoint. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient with full control over the subject line, message content, and sender address (via CRLF injection in the 'wlemail' parameter), effectively turning the website into a full email relay for spam or phishing campaigns."}, {"lang": "es", "value": "El plugin ShopLentor \u2013 WooCommerce Builder for Elementor &amp; Gutenberg +21 Modules \u2013 All in One Solution para WordPress es vulnerable a Abuso de Retransmisi\u00f3n de Correo Electr\u00f3nico en todas las versiones hasta la 3.3.2, inclusive. Esto se debe a la falta de validaci\u00f3n en los par\u00e1metros 'send_to', 'product_title', 'wlmessage' y 'wlemail' en el endpoint AJAX 'woolentor_suggest_price_action'. Esto hace posible que atacantes no autenticados env\u00eden correos electr\u00f3nicos arbitrarios a cualquier destinatario con control total sobre la l\u00ednea de asunto, el contenido del mensaje y la direcci\u00f3n del remitente (mediante inyecci\u00f3n CRLF en el par\u00e1metro 'wlemail'), convirtiendo eficazmente el sitio web en un retransmisor de correo electr\u00f3nico completo para campa\u00f1as de correo no deseado o phishing."}], "id": "CVE-2026-1714", "lastModified": "2026-06-17T10:16:22.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1714", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T12:26:32.188077Z", "version": "2.0.3"}}]}, "published": "2026-02-18T05:16:27.327", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L170"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L189"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L192"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L170"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L189"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L192"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3461704/woolentor-addons/trunk/classes/class.ajax_actions.php?contextall=1"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf326914-6a38-4984-a2a7-66e05f41a96b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin", "source": "cna", "vendor": "devitemsllc"}, "product": "shoplentor_\u2013_all-in-one_woocommerce_growth_&_store_enhancement_plugin", "vendor": "devitemsllc"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:08:40.743379+00:00", "value": {"mitigation_remediation": ["Upgrade ShopLentor to the latest version (\u22653.3.3) which removes the missing validation on the woolentor_suggest_price_action endpoint.", "If an immediate update is not possible, block unauthenticated HTTP POST requests to wp-admin/admin-ajax.php?action=woolentor_suggest_price_action using a Web Application Firewall or by disabling the action in code.", "Restrict or disable the site\u2019s mail\u2011sending capability for unauthenticated users, or configure a mail relay that blocks spoofed sender addresses, to prevent the abused plugin from functioning as an email relay."], "summary": {"action": "Patch Immediately", "impact": "Unauthenticated Email Relay Abuse"}, "threat_synthesis": {"affected_systems": "The flaw affects the devitemsllc:ShopLentor All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress in versions 3.3.2 and earlier, located in the class.ajax_actions.php file\u2019s woolentor_suggest_price_action action; users on these releases should upgrade promptly.", "description_and_impact": "The ShopLentor WooCommerce Builder for Elementor & Gutenberg plugin is vulnerable to an unauthenticated email relay abuse in all releases up to 3.3.2 due to missing validation on the send_to, product_title, wlmessage, and wlemail parameters within the woolentor_suggest_price_action AJAX endpoint, which allows an attacker to inject CRLF sequences in wlemail to forge arbitrary From headers, control subject and body, therefore turning the WordPress site into a full email relay for spam or phishing campaigns.", "risk_and_exploitability": "With a CVSS score of 8.6 and an EPSS score less than 1%, the vulnerability is high severity yet low exploitation probability; the attack can be performed remotely without authentication by sending a crafted POST request to wp-admin/admin-ajax.php?action=woolentor_suggest_price_action, making rapid remediation critical to prevent mass email abuse."}}}}, "created": "2026-02-18T10:32:52.218030+00:00", "updated": "2026-04-15T17:30:10.455391+00:00", "vendors": ["devitemsllc", "devitemsllc$PRODUCT$shoplentor_\u2013_all-in-one_woocommerce_growth_&_store_enhancement_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}