CVE-2024-4566
ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification
The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 2.8.8. This makes it possible for authenticated attackers, with contributor-level access and above, to set arbitrary WordPress options to "true". NOTE: This vulnerability can be exploited by attackers with subscriber- or customer-level access and above if (1) the WooCommerce plugin is deactivated or (2) access to the default WordPress admin dashboard is explicitly enabled for authenticated users.
| CWE | CWE-862 |
| Vendor | devitemsllc |
| Product | shoplentor – all-in-one woocommerce growth & store enhancement plugin |
| Published | May 21, 2024 |
| Last Updated | Apr 8, 2026 |
Get instant alerts for devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin
Be the first to know when new high vulnerabilities affecting devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H