Cart Abandonment Recovery CVE-2026-96901

Exploitation requires the attacker to already know the specific victim's cart session identifier, and the vulnerable plugin must accept the unsigned legacy recovery token format (present in all versions before 2.2.0). No authentication is required (PR:N) and no user interaction is needed (UI:N), but the per-victim session-identifier prerequisite is the dominant limiting factor and is what drives the high attack complexity (AC:H) - the attack cannot be run blindly against arbitrary users. Impact is confined to integrity of a single victim's abandoned-cart record (unsubscribe from recovery emails, apply an arbitrary coupon); there is no confidentiality or availability impact and no code execution.

This is a genuinely low-priority vulnerability despite being an authentication/integrity bypass. The CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) is consistent with the description: exploitation is network-reachable and unauthenticated, but carries high attack complexity because the attacker must first know a specific victim's cart session identifier - a per-victim secret that is not trivially enumerable - and the only impact is limited integrity (I:L) with no confidentiality or availability consequences. Public exploit code exists (reported by WPScan), which raises the practical likelihood that someone could reproduce it, but this is NOT active exploitation: the CVE is not listed in CISA KEV and no EPSS score was provided in the input, so widespread or automated exploitation cannot be inferred. The signals are internally consistent - there is no CVSS-versus-description conflict here. In short, this is a legitimate but minor flaw affecting only the state of individual abandoned-cart records (unsubscribing a victim, applying a coupon), not a high-CVSS-but-low-real-risk mislabel and not a critical issue; its real risk is bounded by the need to know the victim's session ID and by the absence of any code-execution or data-disclosure path.

An attacker who has obtained a victim's cart session identifier (for example via a leaked or guessed recovery link) crafts an unsigned legacy-format recovery token referencing that session and submits it to the plugin's recovery endpoint. Because the plugin does not verify token integrity, it acts on the request and the attacker unsubscribes the victim from recovery emails or forces an arbitrary coupon onto the victim's restored cart. Public proof-of-concept detail is available via WPScan, lowering the effort to reproduce.