ShopLentor WooCommerce Builder for Elementor and Gutenberg Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in the ShopLentor WooCommerce Builder for Elementor and Gutenberg plugin, all versions through 3.1.2. The vulnerability arises in the woolentor_template_proxy function, allowing unauthenticated attackers to send web requests to arbitrary locations from the web application. This could be exploited to query and modify information from internal services.

Impact

Exploitation of this vulnerability allows for server-side request forgery, enabling attackers to make requests to internal services and potentially access or modify sensitive information.

Remediation

Users are advised to update the plugin to version 3.1.3 or a newer patched version.