CVE-2026-6020 is a vulnerability in the ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress. The issue exists in the woolentoropt/v1/custom-action REST API endpoint where the handle_action() method uses the 'callback' parameter from user input directly in call_user_func() without an allowlist. This unsafe reflection (CWE-470) enables authenticated administrators to execute arbitrary PHP callable functions, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions up to and including 3.3.7.

An attacker with Administrator-level access can execute arbitrary PHP functions on the server, leading to full compromise of the WordPress environment. This can result in complete control over the site, data leakage, data modification, or denial of service. The CVSS v3.1 score is 7.2 (High), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator access to trusted users only and monitor for suspicious activity. Avoid exposing the vulnerable REST API endpoint if possible.