IT SBIT Services
Schneeberger
DEEN
CVE tracker

Abandoned Cart Pro for WooCommerce: Authentication bypass via forged recovery links

CVE-2026-97657Critical 9.8Public exploit

← All vulnerabilities

Summary

The WordPress plugin Abandoned Cart Pro for WooCommerce contains a critical authentication bypass (CVSS 9.8). Unauthenticated attackers who hold one legitimate cart-recovery link from their own reminder email can forge tokens for other users' abandoned carts and trigger a login as the victim. Because auto-login is enabled by default, any user who has ever abandoned a cart, including administrators, can be taken over.

Affected

  • Abandoned Cart Pro for WooCommerce, all versions up to and including 10.8.0

Fixed in

  • Version 10.8.1 (vendor changelog, release date October 8, 2026)

Workaround

  • No vendor-published workaround found.
  • Interim option, not confirmed by the vendor: disable the auto-login feature or deactivate the plugin until the update is applied.
  • After updating, consider invalidating outstanding recovery links.

Exploitation

  • Wordfence/CNA SSVC: exploitation none, automatable yes, technical impact total.
  • Not listed in CISA KEV according to a third-party triage source (not checked directly).
  • EPSS 0.00376 according to one aggregator; another lists it as unknown.
  • A public exploit entry was listed on 14 October 2026; its content was not verified.
  • The same parameter is also affected by CVE-2026-102251 (SQL injection), fixed in 10.8.1.

Our recommendation

  • Check all WordPress sites with this plugin, including staging copies, and verify the installed version.
  • Update to 10.8.1 or later immediately.
  • After updating, invalidate outstanding recovery links.
  • Review administrator accounts, password resets and recent logins for unexpected activity.
  • Monitor for CISA KEV addition or further vendor updates.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:04.

Original description (NVD)

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed