CVE-2026-16797: 
WordPress vulnerability analysis and mitigation

CVE-2026-16797 is an Insecure Direct Object Reference (IDOR) vulnerability in the ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress. It affects all versions up to and including 3.4.5, allowing authenticated attackers with contributor-level access or above to read arbitrary wp_options database rows via an unvalidated optionSection parameter. The vulnerability was published on July 28, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The flaw resides in the plugin's REST API handler (woolentor-blocks/includes/classes/Api/Api.php, lines 143, 168, and 476) and a helper function (woolentor-blocks/includes/helper-functions.php, line 7), where the optionSection parameter is accepted from user input without proper authorization validation. An authenticated attacker can supply arbitrary key values to this parameter to retrieve wp_options rows whose values are stored as arrays-of-arrays containing title keys — including internal plugin news feed data, WooCommerce block pattern transients, and third-party plugin configuration records — enabling cross-plugin data leakage (GitHub Advisory, WordPress Trac).

Successful exploitation allows authenticated attackers with contributor-level access or above to read sensitive wp_options data that should be inaccessible at their privilege level, including third-party plugin configuration records and WooCommerce transients. The impact is limited to confidentiality — there is no integrity or availability impact — but the cross-plugin data leakage could expose API keys, configuration secrets, or other sensitive settings stored by co-installed plugins. This information could potentially be leveraged for further attacks against the WordPress installation or connected services (GitHub Advisory, Wordfence).

1. Obtain contributor-level access: Register or compromise a WordPress account with at minimum contributor-level privileges on a site running ShopLentor version 3.4.5 or earlier.
2. Identify the vulnerable API endpoint: Locate the ShopLentor REST API endpoint that accepts the optionSection parameter (referenced in Api.php lines 143 and 168).
3. Craft a malicious request: Send an authenticated HTTP request to the API endpoint, supplying an arbitrary optionSection key value corresponding to a target wp_options row (e.g., a third-party plugin's configuration option name).
4. Retrieve sensitive data: The server returns the contents of the targeted wp_options row — including configuration records, API keys, or transient data stored as arrays-of-arrays with title keys — without validating whether the requesting user is authorized to access that data.
5. Enumerate additional records: Repeat with different optionSection values to enumerate and extract additional sensitive wp_options entries from co-installed plugins (GitHub Advisory, WordPress Trac).

• Logs: WordPress access logs showing repeated authenticated REST API requests to ShopLentor API endpoints with varying optionSection parameter values from a single contributor-level user account.
• Logs: Unusual patterns of API calls to the ShopLentor blocks API outside of normal plugin usage hours or from unexpected IP addresses.
• Network: High-frequency authenticated GET/POST requests to the ShopLentor REST API route from a single source IP, particularly with enumerated or non-standard optionSection values.
• Application: WordPress audit logs (if enabled via a logging plugin) showing a contributor-level user accessing wp_options rows associated with other plugins or sensitive configuration keys.

Update the ShopLentor plugin to version 3.4.6 or later, which contains the patch addressing the missing authorization validation on the optionSection parameter (WordPress Trac Changeset). As an interim measure, restrict contributor-level user access to the affected plugin functionality and audit existing contributor accounts for legitimacy. Additionally, review wp_options for sensitive data exposure and consider using a WordPress security plugin to monitor REST API access patterns (Wordfence, GitHub Advisory).