Abandoned Cart Pro CVE-2026-97668

Exploitation requires the store to run Abandoned Cart Pro for WooCommerce ≤10.8.0 with its guest/persistent abandoned-cart capture active, since the sink is the update_guest_persistent_cart() function processing the guest cart's abandoned_cart_info/meta_value. The specific injectable input is an attacker-controlled guest-checkout field such as the SMS consent field, which must be reachable via the public checkout flow. No authentication, privileges, or user interaction are required (PR:N/UI:N), so any public-facing storefront accepting guest checkouts with this plugin is exposed by default; the main limiting factor is that the vulnerable guest-cart persistence path and the specific capture fields must be enabled, and only the UPDATE query (not the adjacent prepared SELECT/INSERT) is injectable.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is strongly corroborated by the description: the injection sink is reached through guest-checkout fields (e.g. the SMS consent field) populated by unauthenticated visitors, so no authentication or user interaction gating applies, and the attack is network-reachable against any storefront accepting guest checkouts. The technical impact is severe and consistent with C:H/I:H/A:H - time-based blind extraction of arbitrary database contents plus write access to wp_usermeta that has been demonstrated to escalate an attacker-controlled account to administrator, which is effectively full site compromise. However, several real-world-risk signals are MISSING from the input and must not be assumed: no EPSS score was provided, there is no CISA KEV listing, and no POC/exploit-code flag was supplied, so exploitation is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV data means I cannot assert widespread active exploitation; the realistic posture is that this is a readily exploitable, technically high-impact flaw whose active-exploitation status is simply unknown from the supplied data. Note that exploitation is only possible where the guest/abandoned-cart capture flow is active, which slightly narrows the condition versus a truly universal default.

An unauthenticated attacker visits a WooCommerce store running the plugin, begins a guest checkout, and injects SQL into an attacker-controlled checkout field such as the SMS consent value, which is stripslashes()-processed and concatenated into the update_guest_persistent_cart() UPDATE statement. Because the field is persisted to wp_usermeta via an unprepared query, the attacker can perform time-based blind extraction of credentials/secrets and write a crafted wp_capabilities row that promotes an account to administrator. No public exploit code is identified in the provided data, though the escalation technique is described as demonstrated by the reporter.