Critical Authentication Bypass in Abandoned Cart Pro for WooCommerce - CVE-2026-97657

Unauthenticated SQL injection in the Abandoned Cart Pro for WooCommerce plugin (≤10.8.0) allows remote attackers to execute arbitrary SQL commands via attacker-controlled guest checkout fields, leading to database information disclosure and modification of WordPress user metadata. Exploitation can escalate an arbitrary account to administrator by injecting a malicious wp_capabilities row, and the vulnerability is exploitable without authentication or user interaction (CVSS 9.8). No public exploit code has been identified at time of analysis, but the flaw is considered high-priority due to its severe impact and default exposure on public-facing stores with the vulnerable guest cart persistence feature enabled.

Unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows remote attackers to extract sensitive information from a WordPress site's database by forging the plugin's encrypted 'validate' parameter. The parameter is protected with AES-CTR, a malleable stream cipher, so an attacker who abandons a cart using an email address they control can harvest one legitimate token, recover the keystream, and re-encrypt arbitrary SQL; the HMAC integrity check introduced in 10.4.1 is enforced only when the wcap_nonce parameter is present, and omitting that parameter skips the check entirely. CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting unauthenticated, remote, confidentiality-only impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the attack requires only a token-harvest and keystream-recovery step rather than a one-shot injection.