What is the CVSS score of CVE-2026-12585?

CVE-2026-12585 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Abandoned Cart Lite are affected by CVE-2026-12585?

Abandoned Cart Lite for WooCommerce versions before 6.8.2 allow unauthenticated attackers to hijack customer accounts when the plugin's automatic-login feature is enabled.. A patch is available.

Is there a public PoC exploit available for CVE-2026-12585?

Yes, a public proof-of-concept exploit is available for CVE-2026-12585. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12585?

Within 24 hours: Verify whether your WooCommerce installation uses Abandoned Cart Lite for WooCommerce and confirm whether the automatic-login feature is enabled in the plugin settings. Within 7 days: Update the plugin to version 6.8.2 or later on all affected systems; if patching cannot be completed within this timeframe, immediately disable the automatic-login feature as an interim mitigation. Within 30 days: Review account access logs for suspicious cart-recovery link usage patterns, reset passwords for any potentially compromised accounts, and audit cart recovery activity for unauthorized access.

Abandoned Cart Lite CVE-2026-12585

EUVD-2026-44876 HIGH

Improper Authentication (CWE-287)

2026-07-16 WPScan

GHSA-2qxh-5338-qmf6

WordPress Authentication Bypass Abandoned Cart Lite For Woocommerce Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remote and unauthenticated (AV:N/PR:N/UI:N) but token forgery plus the non-default automatic-login dependency justify AC:H; account takeover gives total C/I/A impact within scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 10:31 vuln.today

Patch available

Jul 16, 2026 - 10:18 EUVD

CVE Published

Jul 16, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 16, 2026 - 06:00 cve.org

HIGH 8.1

DescriptionCVE.org

The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.

AnalysisAI

Authentication bypass in the Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 allows unauthenticated attackers to forge cart-recovery links that log them in as arbitrary users when the automatic-login feature is enabled. Because recovery tokens are neither integrity-protected nor bound to the requesting account, an attacker can craft a link that authenticates them as a victim, yielding full account takeover (SSVC technical impact: total). Publicly available exploit code exists (WPScan), though it is not listed in CISA KEV and EPSS is low (0.14%).

Technical ContextAI

The affected component is the Abandoned Cart Lite for WooCommerce plugin, a WordPress/WooCommerce e-commerce add-on that emails customers a 'recovery link' to resume an abandoned checkout, optionally logging them in automatically. The root cause is CWE-287 (Improper Authentication): the cart-recovery token functions as an authentication credential but lacks cryptographic integrity protection and is not bound to a specific user/session. An attacker who can predict, manipulate, or forge the token parameter can therefore have it resolve to an account other than their own. The CPE cpe:2.3:a:unknown:abandoned_cart_lite_for_woocommerce covers all versions prior to 6.8.2; the vulnerability only becomes exploitable for login when the plugin's automatic-login-on-recovery option is enabled.

RemediationAI

Vendor-released patch: upgrade the Abandoned Cart Lite for WooCommerce plugin to version 6.8.2 or later, which is the fixed release per the WPScan advisory (https://wpscan.com/vulnerability/c94475c8-d129-4735-b599-5094efb20cb8/). If you cannot patch immediately, the most direct compensating control is to disable the plugin's automatic-login option in the abandoned-cart recovery settings, which removes the auto-authentication behavior that turns a forged token into account takeover (trade-off: recovered customers must log in manually, slightly reducing recovery conversion). As a stronger stopgap, deactivate the plugin entirely until upgraded (trade-off: loss of abandoned-cart recovery email functionality), and consider WAF rules to scrutinize or rate-limit access to the cart-recovery endpoint. After patching, review logs for anomalous recovery-link logins and consider invalidating existing sessions.