CVE-2025-12493 – This vulnerability allows unauthenticated attac... (How to Fix)

Q: What is the severity of CVE-2025-12493?

CVE-2025-12493 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows unauthenticated attackers to include and execute arbitrary PHP files on WordPress servers running the ShopLentor plugin. Attackers can achieve remote code execution, bypass access controls, or access sensitive data. All WordPress sites using ShopLentor (formerly WooLentor) version 3.2.5 or earlier are affected.

📋 TL;DR

This vulnerability allows unauthenticated attackers to include and execute arbitrary PHP files on WordPress servers running the ShopLentor plugin. Attackers can achieve remote code execution, bypass access controls, or access sensitive data. All WordPress sites using ShopLentor (formerly WooLentor) version 3.2.5 or earlier are affected.

💻 Affected Systems

Products:

ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules (formerly WooLentor)

Versions: All versions up to and including 3.2.5

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with the vulnerable plugin installed. No special configuration needed.

📦 What is this software?

Shoplentor by Hasthemes

View all CVEs affecting Shoplentor →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server compromise via remote code execution, leading to data theft, website defacement, malware distribution, or ransomware deployment.

🟠

Likely Case

Unauthenticated attackers execute arbitrary PHP code to create backdoors, steal sensitive data, or pivot to other systems.

🟢

If Mitigated

Limited impact if file uploads are restricted and server permissions prevent PHP execution in upload directories.

🌐 Internet-Facing: HIGH - WordPress sites are typically internet-facing, and the exploit requires no authentication.

🏢 Internal Only: MEDIUM - Internal WordPress instances could still be exploited by internal attackers or compromised accounts.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability is in publicly accessible AJAX endpoints. Exploitation requires finding or uploading PHP files to include.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.2.6 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3388234/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find ShopLentor/WooLentor. 4. Click 'Update Now' if available. 5. If not, download version 3.2.6+ from WordPress.org and manually update.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the ShopLentor plugin until patched.

wp plugin deactivate woolentor-addons

Restrict file uploads

linux

Block PHP file uploads via web server configuration.

# In Apache .htaccess: <FilesMatch ".*\.php$"> Deny from all </FilesMatch>
# In Nginx: location ~ \.php$ { deny all; }

🧯 If You Can't Patch

Disable the ShopLentor plugin immediately.
Implement web application firewall (WAF) rules to block requests to vulnerable AJAX endpoints.

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins → Installed Plugins. If version is 3.2.5 or lower, you are vulnerable.

Check Version:

wp plugin get woolentor-addons --field=version

Verify Fix Applied:

Confirm plugin version is 3.2.6 or higher after update.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to /wp-admin/admin-ajax.php with 'action' parameter containing 'woolentor' or 'shoplentor'
File inclusion attempts in access logs with paths like '../../' or absolute paths

Network Indicators:

HTTP requests to admin-ajax.php with unusual file paths in parameters
Unexpected outbound connections from web server post-exploitation

SIEM Query:

source="web_access.log" AND (uri="/wp-admin/admin-ajax.php" AND (param="action" AND value="*woolentor*" OR param="*template*" AND value="*../*"))

📊 Metadata

CVE ID: CVE-2025-12493

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-22

EPSS Score: 0.35% exploit probability (57th percentile)

Published: November 4, 2025

Last Updated: November 26, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-12493, you might also want to check these: