Abandoned Cart Pro EUVD-2026-100778

Exploitable against default installations of Abandoned Cart Pro for WooCommerce (≤10.8.0) because the auto-login feature defaults to enabled and is force-enabled during plugin upgrades, requiring no special configuration. The only practical prerequisite is that the attacker obtains one legitimate cart-recovery link from their own reminder email (trivially self-serviced by abandoning a cart) to recover the keystream, and that the targeted victim has at some point abandoned a cart so an abandoned_id exists for them. The HMAC protection is bypassed simply by omitting the wcap_nonce GET parameter (the check only runs when it is non-empty), and no cart-ownership verification ties the decrypted abandoned_id to the user_email, so there is no authentication, user-interaction, or non-default-setting barrier limiting exploitation.

All signals converge on genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with full C/I/A impact (9.8), and the description substantiates this rather than contradicting it: an unauthenticated attacker who simply triggers their own abandoned-cart reminder email obtains the single legitimate recovery link needed to recover the AES-CTR keystream, then forges tokens to log in as any user including administrators. The CWE-639 (IDOR) root cause plus malleable MAC-free encryption and a nonce check that is bypassable by omission make exploitation deterministic, and the auto-login feature being enabled by default and force-enabled on upgrade means essentially every installation is vulnerable without special configuration - so there is no meaningful 'high-CVSS-but-low-real-risk' discount here. The main tempering factors are intelligence gaps rather than technical ones: no EPSS score, KEV status, or POC indicator was supplied in the input, so I cannot confirm active or probable near-term exploitation. The flaw was reported by Wordfence (a credible WordPress-security source), but absence of KEV/EPSS/POC data means exploitation likelihood is currently inferred from exploit simplicity, not from an observed-exploitation signal - treat as urgent-patch-worthy on technical merit while recognizing in-the-wild activity is unconfirmed.

An attacker registers on a victim WooCommerce store, adds an item to their cart, and abandons it to receive a legitimate cart-recovery email containing a valid recovery link. Using that link they recover the AES-CTR keystream, forge a ciphertext (omitting the wcap_nonce parameter to skip the HMAC check) that decrypts to an administrator's abandoned-cart ID, and request it to trigger wp_set_auth_cookie(), logging in as that admin. No public exploit was identified in the provided data, but the technique is fully described and requires no privileged access.