Critical WooCommerce Plugin Flaw (CVE-2025-12493, CVSS 9.8) Allows Unauthenticated RCE, 100,000+ Sites Affect

A critical Local File Inclusion flaw in the ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) exposes unauthenticated attackers to include and execute attacker-supplied PHP files on affected sites. The vulnerability, CVE-2025-12493 with a CVSS of 9.8, affects all versions of the plugin up to 3.2.5 and was fixed in 3.2.6, with the plugin reporting over 100,000 active installations.

If a server allows uploading or placing a PHP file and the vulnerable include is triggered via load_template, the attacker can achieve remote code execution and full site compromise. WordPress site operators using ShopLentor should update to version 3.2.6 immediately; if immediate updating is not possible, deactivate the plugin or restrict access with a WAF or server rule to block requests that exploit load_template parameters.

Administrators should also review logs for suspicious requests, paying particular attention to unusual template or load_template parameters and attempts to traverse paths such as ../../ or paths under wp-content/uploads.