Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-25 | 2 | PoC2 |
| 2026-02-26 | 1 | Disclosure1 |
‼️#POC CVE-2025-12493: ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion CVSS: 9.8 Software Downloads: 5.169.996 Software Active Installs: 90.000 POC: 👇👇👇 #CVE #bugbountytip #wordpress #exploit #bugbounty #bugbountytips #bugbountytip
Post summary
A PoC for CVE-2025-12493 is announced, highlighting an unauthenticated local PHP file inclusion vulnerability with a high CVSS score, but no exploit code or patch details are provided.
🚨 Bug Bounty Tips & Tricks: CVE-2025-12493 From LFI to Full WordPress Compromise 🚨 How a simple unauthenticated LFI in a popular plugin turned into high-impact access 🧵 🔎 1. The Recon: Always test AJAX / dynamic template loading features in Elementor addons. Found that ShopLentor ≤ 3.2.5 was loading local files based on user input → no authentication, no proper sanitization. 🧨 2. The Exploit: Used path traversal payloads to read arbitrary local PHP files. Accessed sensitive files: wp-config.php → database credentials plugin internal files → application logic No login required. 💥 3. The Impact: ✅ Database access → dump users & password hashes ✅ Authentication material disclosure ✅ Full site compromise path #bugbountytip #bugbountytips #infosec #recon
Post summary
The post discloses an unauthenticated LFI in ShopLentor ≤3.2.5, detailing how path traversal can read sensitive files such as wp-config.php, enabling full site compromise.
#POC CVE-2025-12493: ShopLentor <= 3.2.5 - Unauthenticated LFI PHP https://t.co/6ApvgA2RJu
Post summary
A proof‑of‑concept for CVE-2025-12493, an unauthenticated local file inclusion vulnerability in ShopLentor versions up to 3.2.5, is shared via a link.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | hasthemes | shoplentor | - | wordpress | - |