Abandoned Cart Pro WooCommerce CVE-2026-81543

Exploitation requires a subscriber-level (or higher) WordPress account on the target site; on WooCommerce stores, customer self-registration typically satisfies this. The plugin's auto-login feature must be enabled, which is the default configuration - no administrator action is needed to create this condition. The target site must be running Abandoned Cart Pro for WooCommerce version 10.7.1 or earlier. Limiting factors: if public user registration is disabled and the attacker has no existing account, they cannot reach the vulnerable AJAX handlers; if the auto-login feature is explicitly disabled by an administrator, the SMTP interception step does not yield an admin session (though SMTP misconfiguration may still be possible). Authentication at the subscriber level is the minimum threshold confirmed by the PR:L CVSS metric.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) accurately reflects the attack's network reach and low complexity once the prerequisite subscriber account is obtained. On WooCommerce stores - where public user registration is standard practice - a subscriber account is trivially self-provisioned, making PR:L nearly equivalent to PR:N in practice. AC:L is well-justified because the auto-login feature is default-enabled, requiring no unusual configuration. The attack is a multi-stage but straightforward chain: SMTP hijack followed by passive email interception; no brute force, no race condition, and no complex exploitation primitives are needed. A:H in the CVSS is a stretch for the described attack path (the mechanism primarily delivers C:H/I:H through admin privilege escalation rather than a direct availability impact), but transitively valid because full admin access enables site destruction. EPSS data is not provided in the input. No CISA KEV listing and no confirmed public POC, so real-world exploitation is possible but not confirmed. Given that public user registration is common on WooCommerce stores and the attack is low-complexity, this warrants prioritized patching for any internet-facing WooCommerce installation running this plugin.

An attacker self-registers a subscriber account on a WooCommerce store (standard for any e-commerce site accepting customer accounts). Using that session, the attacker posts to wp-admin/admin-ajax.php with action=wcap_save_connector_settings to overwrite the plugin's SMTP host with an attacker-controlled relay server. The attacker then uses wcap_send_manual_email to trigger a recovery email to an administrator account; the email - containing a valid auto-login URL - routes through the attacker's relay, is captured, and grants the attacker immediate full WordPress administrative access.