Cart Abandonment Recovery CVE-2026-96900

Exploitation requires only that the attacker knows (or can guess/harvest) the victim customer's email address, which the plugin uses as the key to select an abandoned-cart record without verifying ownership. No authentication is required (PR:N) and no user interaction is needed (UI:N), and it works against the default behavior of affected versions (before 2.1.4) because the ownership check is simply missing. LIMITING FACTORS: the attacker must target a specific known email per record (not a blind mass-wipe without an email list), impact is confined to abandoned-cart data (no access to passwords, orders, or payment data - C:N), and installing 2.1.4 or later fully remediates by enforcing ownership verification.

This is a genuine but modest-severity issue, not a top-tier emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 MEDIUM) describes a remote, unauthenticated, low-complexity attack with LOW integrity impact and NO confidentiality or availability impact - consistent with the CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR) classification where an attacker manipulates another user's abandoned-cart record. The signals are mostly aligned and point to limited real-world urgency: EPSS is very low (0.17%, 5th percentile), the SSVC framework records Exploitation as 'none' (no observed active exploitation), and the vulnerability is NOT on the CISA KEV list. However, two signals raise the floor on attention: a public exploit exists (WPScan), and SSVC marks the issue as Automatable: yes with Technical Impact: partial, meaning the attack can be scripted at scale against known customer emails. Net: a credible, easily-automatable tampering/data-destruction flaw against a specific class of records, but with no confidentiality exposure and no confirmed exploitation in the wild - this warrants timely patching (update to 2.1.4) rather than crisis response. One caveat to verify: the input lists a 'Authentication Bypass' tag, but the underlying weakness is an authorization/ownership-verification failure (IDOR), not an authentication bypass - do not over-rate this as a login bypass.

An attacker who knows a target customer's email address (easily guessed, harvested, or scraped) sends a crafted unauthenticated request to the plugin endpoint that selects an abandoned-cart record by email, without any ownership verification. Because the plugin does not confirm the requester owns that email, the attacker can delete or overwrite the victim's stored abandoned-cart data. A publicly available exploit (published by WPScan) exists, and SSVC rates the attack as automatable, so it can be run in bulk against lists of customer emails.