Abandoned Cart Lite CVE-2026-12585

Exploitation requires the plugin's automatic-login (auto-login on cart recovery) option to be ENABLED - this is the specific feature that converts a forged recovery token into an authenticated session; without it the login-as-another-user impact does not occur. No authentication is required of the attacker (CVSS PR:N), no user interaction is needed (UI:N), and the attack is over the network (AV:N). Limiting factors: the attacker must forge or predict a valid cart-recovery token that maps to a target account (reflected in AC:H), and the vulnerable configuration is not guaranteed by default, so only stores that turned on automatic-login and run a version before 6.8.2 are affected.

Signals are mixed and should be weighed together rather than in isolation. CVSS 3.1 is 8.1 (High) with AV:N/PR:N/UI:N indicating remote, unauthenticated, no-interaction exploitation, but AC:H reflects real constraints - the token must be forged/predicted and the vulnerable automatic-login option must be enabled. This aligns with the SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: total): high consequence per successful attack but not trivially mass-automatable. EPSS is low at 0.14% (3rd percentile) and the CVE is not in CISA KEV, so there is no evidence of widespread active exploitation. However, publicly available exploit code (WPScan) meaningfully raises practical risk for exposed, misconfigured stores. Net: a genuine priority for sites running the plugin with automatic-login enabled - account takeover is total - but lower urgency for the broader population given the non-default configuration dependency and absence of observed in-the-wild campaigns.

With the plugin's automatic-login option enabled, an attacker crafts a cart-recovery URL containing a forged or manipulated recovery token that references a target victim's account rather than their own. When the attacker visits the link, the plugin validates the unbound token and automatically authenticates the attacker's browser as the victim, granting full access to that user's account. Publicly available exploit code from WPScan lowers the effort required, though the AC:H rating reflects the need to forge a valid token and the dependency on the non-default automatic-login setting.