Introduction
A critical Local File Inclusion flaw in ShopLentor lets attackers execute arbitrary PHP code and access sensitive files on over 100,000 WordPress sites that use the plugin. The attacker does not need to log in, so an unauthenticated user can compromise an e-commerce store. Potential outcomes include data theft or a full site takeover.
ShopLentor (formerly WooLentor) is a widely used WordPress plugin that integrates WooCommerce with the Elementor and Gutenberg page builders. It has millions of downloads and a large active user base, and many WordPress e-commerce stores depend on it.
Technical Information
CVE-2025-12493 is a Local File Inclusion (LFI) vulnerability in ShopLentor for WordPress that affects all versions up to and including 3.2.5. The flaw is in the load_template function, which does not properly sanitize user-supplied file paths. An attacker can use directory traversal sequences such as ../ to include arbitrary files from the server's filesystem.
The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). To exploit it, an attacker sends crafted requests to endpoints that call the vulnerable function and points them at files like wp-config.php, or at any PHP file the attacker can upload or access. A successful attack can disclose sensitive information, and if the included file is a malicious PHP file, it can lead to remote code execution.
No code snippets or proof of concept for this vulnerability have been released publicly. The root cause is improper input validation of the file path parameter that the load_template function handles. Because the attack requires no authentication, both the risk and the potential impact are higher.
Affected Systems and Versions
- Product: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules (formerly WooLentor)
- Affected Versions: All versions up to and including 3.2.5
- Vulnerable Configuration: Any WordPress installation with a vulnerable version of ShopLentor active
Vendor Security History
WPScan and Wordfence have documented earlier security issues in ShopLentor, mostly Cross-Site Scripting (XSS) vulnerabilities. The vendor has patched many of them, but input validation flaws keep coming back, which suggests the vendor still struggles with secure development practices. CVE-2025-12493 is an unauthenticated LFI, a significant escalation in risk over the XSS issues that came before it.
