Atomic Edge analysis of CVE-2026-61973 (metadata-based):
This vulnerability is a missing authorization issue in the ShopLentor Pro WordPress plugin, affecting versions up to and including 2.8.5. The flaw allows authenticated attackers with subscriber-level access to perform unauthorized actions due to a missing capability check on a function. The vulnerability has a CVSS score of 4.3 (medium severity), with the main impact being a low-level integrity change without direct data exposure or privilege escalation.
Root Cause:
The CWE classification (CWE-862 Missing Authorization) and the vulnerability description indicate that a specific function in the plugin lacks a sufficient capability check. In WordPress plugins, this typically occurs in AJAX handlers, REST API endpoints, or admin-post handlers where the developer checks for a nonce but forgets to verify user capabilities, or uses hooks that are accessible to lower-privileged users. Since no source code is available, the exact function is not confirmed, but Atomic Edge analysis infers that the vulnerable code is likely an AJAX action registered with both ‘wp_ajax_nopriv_’ and ‘wp_ajax_’ hooks or an AJAX action that only checks nonce validity without verifying user roles. The missing check allows any authenticated user, including subscribers, to invoke the function.
Exploitation:
An attacker who has a subscriber account can craft a request to the WordPress AJAX handler at /wp-admin/admin-ajax.php, setting the ‘action’ parameter to the vulnerable hook name. The exact action name is not disclosed in the metadata, but the plugin slug ‘woolentor-addons-pro’ suggests it may be something like ‘woolentor_ajax_action’ or a similar prefixed hook. The attacker will include any required parameters that the function expects, and because there is no capability check, the function executes. The request does not need a valid nonce if the function does not verify one, but the attacker may include one if the function only checks nonce and not capabilities. Atomic Edge research suggests that a realistic payload would be a simple POST request to admin-ajax.php with the action parameter set to the vulnerable handler, and potentially parameters that trigger the unauthorized state change.
Remediation:
To fix this vulnerability, the plugin developers must add a proper capability check to the affected function. This typically involves using current_user_can() with an appropriate capability such as ‘edit_posts’ or a custom capability for the specific action. For AJAX handlers, the check should be placed at the beginning of the callback function before any action is taken. The patch in version 2.8.6 likely adds a capability check to the vulnerable function. WordPress also recommends using the check_ajax_referer() function to verify nonces, but the primary fix is to ensure the user has the necessary permissions to perform the action.
Impact:
Successful exploitation allows an authenticated attacker with subscriber-level access to perform an action they are not authorized to do. The CVSS vector (C:N/I:L/A:N) indicates that the vulnerability does not directly compromise confidentiality or availability, but it does allow a low-level integrity impact. This could lead to unauthorized changes to plugin settings or data, which might affect the site’s appearance or functionality. The impact is limited to the specific action the vulnerable function performs, and without code analysis, the exact consequence cannot be determined, but it likely involves modifying some option or content without authorization.
