WooCommerce Cart Abandonment Recovery CVE-2026-39470

Requires an authenticated WordPress session as a shop_manager (or any role that the plugin's vulnerable endpoint treats as equivalent), the vulnerable WooCommerce Cart Abandonment Recovery plugin installed and active in a version prior to 2.1.0, and network reachability to /wp-admin or the plugin's AJAX/REST endpoint. No user interaction from a victim administrator is needed (UI:N) and attack complexity is low (AC:L). Exploitation is limited by the PR:H prerequisite - sites that do not provision shop_manager accounts to semi-trusted users, or that have already upgraded to 2.1.0, are not exposed; sites running the plugin in a deactivated state are also not affected.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H signals network-reachable, low-complexity exploitation that nonetheless requires high privileges (an existing shop_manager account) and yields full confidentiality, integrity, and availability impact on the WordPress instance - consistent with a role-to-admin escalation. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so widespread opportunistic abuse is not currently indicated; however, Patchstack-reported WordPress privilege flaws are frequently weaponised once advisory details circulate, especially on multi-tenant or marketplace sites where shop_manager accounts are routinely delegated to third parties. The realistic priority is high for any site that grants shop_manager to non-fully-trusted staff or contractors, and moderate otherwise; note that EPSS and KEV data are absent from the input, so quantitative likelihood cannot be confirmed.

An attacker who has obtained or been delegated a WordPress shop_manager account - for example a contracted store operator, a compromised staff credential, or a malicious insider on a multi-tenant WooCommerce site - authenticates and invokes the vulnerable Cart Abandonment Recovery handler to elevate their own (or a newly created) account to administrator-equivalent privileges. From there they can install arbitrary plugins, exfiltrate customer order data, and pivot to full site takeover. No public exploit is identified at time of analysis, but the advisory describes the bug class clearly enough that a working PoC could be reconstructed.