Critical SQL Injection in WordPress Abandoned Cart Pro for WooCommerce ≤10.8.0 - CVE-2026-97668

Unauthenticated account takeover in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows any remote attacker to forge a cart-recovery token and force WordPress to authenticate them as an arbitrary user, including administrators, via wp_set_auth_cookie(). The flaw combines MAC-free AES-CTR token encryption with a keystream-recovery attack, an HMAC nonce check that is skipped entirely when the wcap_nonce parameter is omitted, and a missing ownership check between the decrypted abandoned_id and the attacker-supplied user_email. Exploitation requires the attacker to have one legitimate cart-recovery link of their own plus a victim who has previously abandoned a cart, and because the auto-login feature is enabled by default and force-enabled on upgrade, default installations are exposed; no public exploit code has been identified at time of analysis, but the assessed risk is high and no CISA KEV entry is associated with this issue.

Unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows remote attackers to extract sensitive information from a WordPress site's database by forging the plugin's encrypted 'validate' parameter. The parameter is protected with AES-CTR, a malleable stream cipher, so an attacker who abandons a cart using an email address they control can harvest one legitimate token, recover the keystream, and re-encrypt arbitrary SQL; the HMAC integrity check introduced in 10.4.1 is enforced only when the wcap_nonce parameter is present, and omitting that parameter skips the check entirely. CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting unauthenticated, remote, confidentiality-only impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the attack requires only a token-harvest and keystream-recovery step rather than a one-shot injection.