EUVD-2026-43358Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable, unauthenticated alternate auth path; partial C/I impact consistent with session-level access; no availability impact or scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.12.
AnalysisAI
Authentication bypass in VillaTheme's Abandoned Cart Recovery for WooCommerce (versions through 1.1.12) allows unauthenticated remote attackers to access protected functionality via an alternate authentication path or channel (CWE-288). The CVSS vector confirms network-reachable, zero-complexity exploitation requiring no privileges or user interaction, yielding partial confidentiality and integrity compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and unauthenticated nature elevate practical risk for any WooCommerce store running this plugin.
Technical ContextAI
CWE-288 (Authentication Bypass Using an Alternate Path or Channel) describes a class of flaw where authentication can be circumvented by targeting an endpoint or code path that the developer inadvertently left unprotected or that relies on a weaker authentication mechanism - such as a token-based 'auto-login' link commonly used in abandoned cart recovery email flows. The affected product (CPE: cpe:2.3:a:villatheme:abandoned_cart_recovery_for_woocommerce:*:*:*:*:*:*:*:*) is a WordPress WooCommerce plugin that emails customers unique recovery links to resume abandoned checkout sessions. These token-based links, if insufficiently validated, can serve as an alternate authentication channel exploitable by a third party to assume a legitimate user session on the WooCommerce store.
RemediationAI
Update the Abandoned Cart Recovery for WooCommerce plugin beyond version 1.1.12 immediately; check the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woo-abandoned-cart-recovery/vulnerability/wordpress-abandoned-cart-recovery-for-woocommerce-plugin-1-1-12-broken-authentication-vulnerability for a confirmed patched release version, as no exact fix version was present in the available intelligence data. If a patched release is not yet available, the most targeted compensating control is to temporarily deactivate the plugin via the WordPress admin panel, which removes the vulnerable endpoint from the attack surface at the cost of disabling abandoned cart email functionality. Alternatively, a Web Application Firewall (WAF) rule blocking unauthenticated access to the plugin's cart recovery callback endpoints can reduce exposure, though this requires identifying the specific REST or front-end routes the plugin registers. Restricting the WordPress installation to authenticated users only is not a viable workaround since the cart recovery flow is by design accessible without login.
A Stored Cross-Site Scripting (XSS) vulnerability exists in VillaTheme's Abandoned Cart Recovery for WooCommerce plugin
The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today