CVE-2026-6020 describes an unsafe reflection vulnerability (CWE-470) in the ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress. The vulnerability exists in the woolentoropt/v1/custom-action REST API endpoint where the handle_action() method calls user-supplied input directly via call_user_func() without restricting allowed callbacks. This flaw permits authenticated users with Administrator privileges or higher to execute arbitrary PHP callable functions by manipulating the 'callback' parameter. The issue affects all plugin versions up to and including 3.3.7.

Successful exploitation allows an authenticated administrator to execute arbitrary PHP code on the server, leading to full compromise of the WordPress site, including confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to the woolentoropt/v1/custom-action endpoint. Avoid exposing this REST API endpoint unnecessarily. Follow vendor updates for patches addressing this vulnerability.