Abandoned Cart Pro EUVD-2026-100777

Target must be a WordPress site running Abandoned Cart Pro for WooCommerce version 10.8.0 or earlier with the abandoned-cart tracking functionality active (default behavior of the plugin). The attacker must be able to abandon a cart using an email address they control to harvest one legitimate AES-CTR token, then exploit the stream cipher's malleability to recover the keystream and forge a ciphertext in the 'validate' parameter. Critically, the request must OMIT the wcap_nonce parameter, because the HMAC integrity check added in 10.4.1 is enforced only when that parameter is present - supplying it would block the forgery. No authentication is required (PR:N), no user interaction, and no non-default configuration is needed; the main limiting factor is the attacker's need to perform the token-harvest and keystream-recovery step rather than a one-shot injection.

This is a genuine priority, not a high-CVSS-but-low-risk paper issue, though it falls short of worst-case. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) indicates remote, unauthenticated, low-complexity exploitation with high confidentiality impact and no integrity/availability impact - consistent with a read-oriented SQL injection used to exfiltrate database contents (WordPress user hashes, customer PII, order data). No EPSS score, no CISA KEV listing, and no POC/exploit-availability signal were supplied in the input, so exploitation status is: no public exploit identified at time of analysis. The notable tension is complexity: the attack is not a trivial single-request injection - it requires first obtaining a legitimate AES-CTR token (by abandoning a cart with an attacker-controlled email), recovering the keystream, and forging a ciphertext, while omitting the wcap_nonce parameter to skip the HMAC check added in 10.4.1. This chain is deterministic and reliable for a competent attacker (hence AC:L is defensible), but it is more involved than a generic SQLi, which realistically narrows exploitation to deliberate attackers rather than opportunistic mass scanners in the immediate term. Net: credible, remotely reachable data-theft vulnerability in a WordPress e-commerce plugin, discovered/reported by Wordfence - treat as a high-priority patch, while noting that the absence of EPSS/KEV/POC data means active-exploitation risk cannot be confirmed from the provided inputs.

An attacker visits a store running a vulnerable version of Abandoned Cart Pro for WooCommerce and abandons a cart using an email address they control, obtaining a legitimate encrypted token. Because AES-CTR is a malleable stream cipher, the attacker recovers the keystream from this known token and forges a ciphertext embedding arbitrary SQL into the 'validate' parameter, omitting wcap_nonce so the HMAC integrity check is never invoked. The appended SQL is executed against the WordPress database, letting the unauthenticated attacker extract sensitive data such as user credentials and customer information. No public exploit was identified in the provided data.