External risk intelligence

ShopLentor WooCommerce Builder Local File Inclusion Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-12493

The vulnerability affects a WordPress plugin designed to enhance public-facing e-commerce websites. Because WordPress sites are almost exclusively deployed as internet-accessible web applications to facilitate user interaction and shopping, the vulnerable component is routinely exposed to the public internet by design.

Path Traversal

Hasthemes Shoplentor

before 3.2.6

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in a WordPress plugin that allows users to build e-commerce storefronts. The flaw could enable unauthorized individuals to execute malicious code on affected servers, potentially compromising sensitive data or disrupting services. Confirming whether this plugin is in use and confirming its version is the primary leadership concern.

Unauthenticated code execution risk in e-commerce plugin.
Affects public-facing WordPress storefronts.
Confirm relevance and exposure for WordPress sites.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a WordPress site that uses the affected plugin. This request targets the 'load_template' function, which improperly handles file paths. By manipulating this function, an unauthenticated attacker can trick the plugin into loading and executing arbitrary PHP files from the server, potentially leading to unauthorized access and control.

No authentication required for attack.
Triggers via a vulnerable template loading function.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to include and execute arbitrary PHP files on the server, potentially leading to the disclosure of sensitive information or execution of malicious code, when supported by the advisory's conditions for file uploads and inclusions.

System files and sensitive data.
Remote inclusion of arbitrary PHP files.
Bypass access controls and execute code.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ShopLentor WordPress plugin's Local File Inclusion vulnerability requires immediate attention from the platform or application teams responsible for managing WordPress instances. The first practical step is to identify all instances of this plugin across your WordPress deployments, determine their reachability, and confirm their business criticality. Once ownership is confirmed, remediation can be planned based on the assessed risk.

WordPress platform and application teams own this.
Verify affected plugin instances and exposure.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ShopLentor?

ShopLentor is a WordPress plugin used to build and manage e-commerce storefronts. It extends WooCommerce by adding specialized modules for product displays and page building. Because it integrates with Elementor and Gutenberg, it is a common choice for site owners who need flexible, custom-designed shopping experiences.

What does Local File Inclusion mean for CVE-2025-12493?

This vulnerability is classified as CWE-22, Improper Limitation of a Pathname to a Restricted Directory. In plain terms, the plugin fails to properly verify file paths it processes. This allows an attacker to manipulate the 'load_template' function to point to unauthorized files on the server, forcing the system to execute malicious PHP code instead of legitimate site templates.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted network request to the vulnerable site. The vulnerability resides specifically within the 'load_template' function. It is important to note that the flaw does not require the attacker to have a user account or any prior authentication to interact with the plugin and attempt the inclusion of files.

Is my site at risk from this ShopLentor vulnerability?

According to Halo Surface Signal, this plugin is designed for public-facing e-commerce storefronts. Because these sites are intentionally accessible to the internet to allow customer shopping, they are naturally exposed to this flaw. If you run a WordPress site using a version of ShopLentor up to 3.2.5, your site is likely reachable by attackers.

What should I do if I am running this plugin?

Your first step is to perform an inventory of your WordPress environments to identify all instances where ShopLentor is active and verify the specific version number. Once you confirm the plugin is in use, prioritize updating to version 3.2.6 or later to remove the vulnerability. Coordinate with your web or application management team to ensure these updates are applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.