PT-2025-44993 · Automattic+2 · Woocommerce+3

Michael Mazzolini · Published 2025-11-04 · Updated 2026-02-26 · CVE-2025-12493

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ShopLentor versions prior to 3.2.6

Description The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is susceptible to Local File Inclusion in versions up to and including 3.2.5. This allows unauthenticated attackers to include and execute arbitrary .php files on the server through the load template function. Successful exploitation could lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads are permitted.

Recommendations Update ShopLentor to version 3.2.6 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-12493

Affected Products

Elementor

Gutenberg

Shoplentor

Woocommerce

References · 17

• https://osv.dev/vulnerability/CVE-2025-12493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12493 · Security Note
• https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L42 · Note
• https://t.me/CVEtracker/36506 · Telegram Post
• https://twitter.com/gothburz/status/1989317897080946691 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/includes/addons/product-grid/base/class.product-grid-base.php#L378 · Note
• https://twitter.com/SecAideInfo/status/1986739517852701004 · Twitter Post
• https://t.me/cveNotify/141532 · Telegram Post
• https://twitter.com/viii_norahc/status/2026926885134114909 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L213 · Note
• https://twitter.com/viii_norahc/status/2026683133848891694 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/12bb4bb9-e908-43ad-8fb1-59418580f5e1?source=cve · Note
• https://t.me/pentestingnews/70547 · Telegram Post
• https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L241 · Note
• https://twitter.com/viii_norahc/status/2026705642422153464 · Twitter Post