ShopLentor < 3.3.8 - Admin+ Arbitrary Function Execution via 'callback' Parameter via REST API

Description

The plugin is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP callable functions via the 'callback' parameter.