CVE-2026-1714

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all versions up to, and including, 3.3.2. This is due to the lack of validation on the 'send_to', 'product_title', 'wlmessage', and 'wlemail' parameters in the 'woolentor_suggest_price_action' AJAX endpoint. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient with full control over the subject line, message content, and sender address (via CRLF injection in the 'wlemail' parameter), effectively turning the website into a full email relay for spam or phishing campaigns.

• CWE-93

• https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L170
• https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L189
• https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.3.1/classes/class.ajax_actions.php#L192
• https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L170
• https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L189
• https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L192
• https://plugins.trac.wordpress.org/changeset/3461704/woolentor-addons/trunk/classes/class.ajax_actions.php?contextall=1
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cf326914-6a38-4984-a2a7-66e05f41a96b?source=cve

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1709A flaw was found in Keylime. The Keylime registrar, since ve…9.8
• CVE-2026-1710The WooPayments: Integrated WooCommerce Payments plugin for …6.5
• CVE-2026-17107A flaw was found in the cluster-proxy service-proxy componen…8.5
• CVE-2026-1711Pega Platform versions 8.1.0 through 25.1.1 are affected by …4.8
• CVE-2026-1712Incorrect privilege assignment vulnerability in HYPR Server …5.8
• CVE-2026-1713IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.4…5
• CVE-2026-1715An input validation vulnerability was reported in the Device…7.1
• CVE-2026-1716An input validation vulnerability was reported in the Device…7.1
• CVE-2026-17161The WowStore – Store Builder & Product Blocks for WooCommerc…6.4
• CVE-2026-17162The WowStore – Store Builder & Product Blocks for WooCommerc…6.4
• CVE-2026-17166The Event Booking Manager for WooCommerce – Sell Tickets, Ev…4.3
• CVE-2026-1717An input validation vulnerability was reported in the Lenovo…6.8