CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'render' function in includes/addons/wl_faq.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.
Explanation of Vulnerability in Simple Terms
ShopLentor versions up to 2.9.8 expose sensitive information to authenticated users. A logged-in user with low privileges can access data they should not be able to view. The vulnerability requires a valid account but no special interaction. Update to a version newer than 2.9.8 to resolve this issue.
What an attacker can do
Read sensitive information accessible only to higher-privilege users or other site users.
Potential impact on your site
Customer or subscriber accounts can view data not intended for their role, risking exposure of private information.
Conditions required to exploit
Attacker must have a valid low-privilege account on the site (e.g., customer or subscriber).
Key dates
External resources
Related vulnerabilities
