The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress contains a CWE-22 Path Traversal vulnerability (CVE-2025-12493) in its 'load_template' function. This flaw allows unauthenticated attackers to perform Local File Inclusion by manipulating pathname inputs, enabling them to include and execute arbitrary PHP files on the server. This can result in complete compromise of the affected system, including code execution, data disclosure, and bypassing access controls. The vulnerability affects all versions up to and including 3.2.5. The CVSS 3.1 base score is 9.8 (critical), reflecting its high impact and ease of exploitation. No patch or official fix has been documented in the provided data.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the server hosting the vulnerable plugin. This can lead to full system compromise, including unauthorized access to sensitive data, bypass of security controls, and disruption of service. The critical CVSS score of 9.8 reflects the high confidentiality, integrity, and availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for updates from the vendor or trusted security sources is recommended to apply any forthcoming patches promptly.