EUVD-2026-39753
GHSA-f6fv-fqq6-cjgw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attacker needs no credentials (PR:N) but must induce victim interaction (UI:R); impact is integrity-only and limited, with no scope change or data exposure.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.
AnalysisAI
Cross-Site Request Forgery in the Abandoned Cart Lite for WooCommerce WordPress plugin (versions 6.8.0 and below) enables unauthenticated remote attackers to perform unauthorized state-changing actions by luring an authenticated site user into visiting a malicious page. The CVSS score of 4.3 (Medium) reflects a limited integrity impact with no confidentiality or availability consequences. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-352 (Cross-Site Request Forgery) describes a failure to verify that an incoming HTTP request originated from the legitimate application interface rather than a third-party site. WordPress plugins are expected to use nonce validation (wp_verify_nonce) on all state-changing endpoints. The Abandoned Cart Lite for WooCommerce plugin - a WooCommerce add-on that tracks and recovers abandoned shopping carts - fails to enforce this validation on at least one sensitive request handler. This allows a browser carrying an authenticated session cookie to be silently weaponized via a crafted cross-origin request, bypassing the plugin's access controls without requiring the attacker to hold any credentials.
RemediationAI
Update the Abandoned Cart Lite for WooCommerce plugin to a version above 6.8.0 as the primary remediation; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woocommerce-abandoned-cart/vulnerability/wordpress-abandoned-cart-lite-for-woocommerce-plugin-6-8-0-cross-site-request-forgery-csrf-vulnerability) should be checked for the exact patched release version, which was not specified in the available intelligence data. No patched version number was independently confirmed from input data. As a compensating control if immediate update is not possible, restrict administrative access to the WordPress dashboard by IP allowlisting or a WAF rule that blocks cross-origin POST requests to wp-admin paths; note this may interfere with legitimate remote management workflows. Disabling the plugin entirely eliminates the attack surface at the cost of cart abandonment recovery functionality.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today