Abandoned Cart Pro CVE-2026-66682

The prerequisite is a WordPress site running WooCommerce with the Abandoned Cart Pro for WooCommerce plugin at version 10.4.0 or earlier, with the vulnerable endpoint network-reachable - the default state for a live store. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special configuration, and no user interaction are required. The main limiting factors are simply that the plugin must be installed and active and at an affected version (<= 10.4.0); sites without this plugin, or already upgraded past 10.4.0, are not exposed. Note the description's 'privilege escalation' phrasing versus PR:N - confirm the precise unauthenticated entry point via the Patchstack advisory.

The signals align toward high priority: the provider CVSS is 9.8 with a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/PR:N/UI:N) and high impact across C/I/A, which matches an unauthenticated privilege-escalation description. That combination - network-reachable, no auth, no user interaction - is exactly what tends to be automated against WordPress at scale once a public exploit appears, so operators of any size should treat this as urgent. Tempering factors: EPSS is not provided in the input, the CVE is not in CISA KEV, and no POC is referenced, so there is currently no evidence of active exploitation - the urgency is driven by the vector and the wide, automation-friendly WordPress attack surface rather than confirmed in-the-wild activity. One caveat to verify: the description labels this 'privilege escalation' (which often implies an existing foothold), yet the CVSS encodes PR:N (unauthenticated); the vector should be taken as the controlling signal here, but confirm the exact entry point against the Patchstack advisory.

An attacker sends a crafted unauthenticated HTTP request to a vulnerable plugin endpoint on a WooCommerce store running Abandoned Cart Pro <= 10.4.0, invoking a privileged action that the plugin fails to restrict. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires no credentials, no user interaction, and low complexity, so the attacker can escalate to a privileged role or perform admin-level operations and take over the site. No public POC is referenced, but the low barrier makes mass, automated scanning likely if exploit code emerges.