ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'

The impact of CVE-2025-12493 is severe due to the unrestricted code execution it enables. An attacker exploiting this vulnerability can upload a malicious PHP file, include it via the 'load_template' function, and execute arbitrary code with the privileges of the web server user. This could lead to the theft of sensitive data, including database credentials, user information, and potentially even the entire WordPress installation. Furthermore, the attacker could establish a persistent backdoor, allowing them to regain access to the system at any time. The ability to execute arbitrary code effectively grants the attacker full control over the affected WordPress site, similar to the impact of remote code execution vulnerabilities.

WordPress websites utilizing the ShopLentor plugin, particularly those with limited security configurations or shared hosting environments, are at significant risk. Sites with older, unpatched WordPress installations or those lacking robust input validation practices are especially vulnerable. Administrators who have not recently reviewed plugin security are also at increased risk.

• wordpress / composer / npm:

grep -r 'load_template' /var/www/html/wp-content/plugins/shop-lentor/

• generic web:

curl -I http://your-wordpress-site.com/wp-content/plugins/shop-lentor/load_template?file=../../../../etc/passwd | grep 'Content-Type:'

• wordpress / composer / npm:

wp plugin list | grep shop-lentor

1. 2025-11-04Disclosure

   disclosure

1. Reserviert2025-10-29
2. Veröffentlicht2025-11-04
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-12493 is to immediately upgrade the ShopLentor plugin to a patched version. The vendor has not yet released a fixed version, so temporary workarounds are necessary. Consider restricting file uploads to only explicitly allowed file types and implementing strict input validation on the 'load_template' parameter. Web Application Firewalls (WAFs) can be configured to block requests containing suspicious file paths or patterns. Monitor web server logs for unusual activity, particularly attempts to access or include unexpected PHP files. After upgrading to a patched version, verify the fix by attempting to trigger the LFI vulnerability and confirming that it is no longer exploitable.