CVE-2025-3775: CWE-918 Server-Side Request Forgery (SSRF) in devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, and can be used to query and modify information from internal services.
AI Analysis
Technical Summary
The ShopLentor WordPress plugin (formerly WooLentor) contains an SSRF vulnerability (CWE-918) in the woolentor_template_proxy function in all versions up to 3.1.2. This flaw allows unauthenticated attackers to induce the server to make HTTP requests to arbitrary locations, potentially enabling access to internal network resources or services that are not otherwise exposed externally. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality and integrity impact without availability impact. No patch or official fix information is currently available from the vendor or public advisories.
Potential Impact
An attacker can exploit this SSRF vulnerability to make the vulnerable server perform HTTP requests to arbitrary URLs, including internal network services. This can lead to unauthorized information disclosure and modification of internal resources accessible from the server. The impact is limited to confidentiality and integrity, with no direct availability impact reported. Since the vulnerability is exploitable without authentication, it poses a risk to any site running affected versions of the plugin.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the ShopLentor plugin if possible or restricting access to the vulnerable functionality. Monitoring for updates from the vendor devitemsllc is recommended to apply any forthcoming patches promptly.
CVE-2025-3775: CWE-918 Server-Side Request Forgery (SSRF) in devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
Description
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, and can be used to query and modify information from internal services.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The ShopLentor WordPress plugin (formerly WooLentor) contains an SSRF vulnerability (CWE-918) in the woolentor_template_proxy function in all versions up to 3.1.2. This flaw allows unauthenticated attackers to induce the server to make HTTP requests to arbitrary locations, potentially enabling access to internal network resources or services that are not otherwise exposed externally. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality and integrity impact without availability impact. No patch or official fix information is currently available from the vendor or public advisories.
Potential Impact
An attacker can exploit this SSRF vulnerability to make the vulnerable server perform HTTP requests to arbitrary URLs, including internal network services. This can lead to unauthorized information disclosure and modification of internal resources accessible from the server. The impact is limited to confidentiality and integrity, with no direct availability impact reported. Since the vulnerability is exploitable without authentication, it poses a risk to any site running affected versions of the plugin.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the ShopLentor plugin if possible or restricting access to the vulnerable functionality. Monitoring for updates from the vendor devitemsllc is recommended to apply any forthcoming patches promptly.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-04-17T16:40:43.199Z
- Cisa Enriched
- true
Threat ID: 682d983ec4522896dcbf034b
Added to database: 5/21/2025, 9:09:18 AM
Last enriched: 4/9/2026, 5:24:33 PM
Last updated: 5/8/2026, 10:47:50 PM
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.