CVE-2026-6020

The CVSS 7.2 score for CVE-2026-6020 obscures a more dangerous reality: this isn't merely another admin-capability vulnerability. The `call_user_func()` endpoint in ShopLentor (WooLentor) versions up to 3.3.7 allows arbitrary PHP function execution, and the critical distinction is *how* that execution differs from the file-editing capabilities Administrators already possess through WordPress's plugin and theme editors. A WordPress Administrator with plugin-editor or theme-editor permissions can write arbitrary PHP directly into server files. This triggers file integrity monitors, antivirus scans, and WAF rules that watch for filesystem modifications. The ShopLentor REST endpoint achieves equivalent code execution through `call_user_func()` without creating modified PHP files—traditional security controls that evolved around file-based detection have no visibility into this execution path. This is the real risk: the vulnerability bypasses compensating controls designed for a different attack surface. For defenders, this changes the detection strategy. Monitor REST API traffic patterns to the woolentoropt endpoint, not just file diffs. The endpoint should be rate-limited and require additional authentication verification beyond standard WordPress session cookies. If your WAF or CDN logs show unusual callback patterns to this endpoint, investigate immediately—the absence of file modifications shouldn't be treated as evidence of benign activity. The capability-equivalence argument (that admins can already do this via file editing) is technically correct but operationally irrelevant. The method matters. This endpoint collapses the forensic gap that normally makes admin file edits auditable and detectable post-incident. Treat this as host-compromise severity regardless of the 7.2 score, because it enables code execution without the audit trail defenders rely on.

Reviewed through automated stages and approved by a human before publication.