Abandoned Cart Pro For Woocommerce
Monthly
Unauthenticated account takeover in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows any remote attacker to forge a cart-recovery token and force WordPress to authenticate them as an arbitrary user, including administrators, via wp_set_auth_cookie(). The flaw combines MAC-free AES-CTR token encryption with a keystream-recovery attack, an HMAC nonce check that is skipped entirely when the wcap_nonce parameter is omitted, and a missing ownership check between the decrypted abandoned_id and the attacker-supplied user_email. Exploitation requires the attacker to have one legitimate cart-recovery link of their own plus a victim who has previously abandoned a cart, and because the auto-login feature is enabled by default and force-enabled on upgrade, default installations are exposed; no public exploit code has been identified at time of analysis, but the assessed risk is high and no CISA KEV entry is associated with this issue.
Unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows remote attackers to extract sensitive information from a WordPress site's database by forging the plugin's encrypted 'validate' parameter. The parameter is protected with AES-CTR, a malleable stream cipher, so an attacker who abandons a cart using an email address they control can harvest one legitimate token, recover the keystream, and re-encrypt arbitrary SQL; the HMAC integrity check introduced in 10.4.1 is enforced only when the wcap_nonce parameter is present, and omitting that parameter skips the check entirely. CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting unauthenticated, remote, confidentiality-only impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the attack requires only a token-harvest and keystream-recovery step rather than a one-shot injection.
Unauthenticated SQL injection in the Abandoned Cart Pro for WooCommerce plugin (≤10.8.0) allows remote attackers to execute arbitrary SQL commands via attacker-controlled guest checkout fields, leading to database information disclosure and modification of WordPress user metadata. Exploitation can escalate an arbitrary account to administrator by injecting a malicious wp_capabilities row, and the vulnerability is exploitable without authentication or user interaction (CVSS 9.8). No public exploit code has been identified at time of analysis, but the flaw is considered high-priority due to its severe impact and default exposure on public-facing stores with the vulnerable guest cart persistence feature enabled.
Privilege escalation in the Abandoned Cart Pro for WooCommerce WordPress plugin (all versions through 10.7.1) allows authenticated subscribers to gain full WordPress administrative access by hijacking the plugin's SMTP email routing. Missing capability checks and nonce verification on at least four AJAX endpoints - including wcap_save_connector_settings - permit any subscriber-level user to silently redirect outbound SMTP traffic through an attacker-controlled mail server. Once SMTP is redirected, the attacker intercepts auto-login recovery links sent to administrators and authenticates as admin without any further credentials. No public exploit has been identified at time of analysis, but the attack exploits a default-enabled feature, significantly lowering the bar for abuse on any standard installation.
Privilege escalation in Abandoned Cart Pro for WooCommerce (Tyche Softwares) affects all versions up to and including 10.4.0, allowing an unauthenticated remote attacker to gain elevated privileges over a WordPress site. The CVSS 3.1 vector (AV:N/PR:N/UI:N) with a 9.8 score indicates the flaw is reachable over the network without credentials or user interaction, and yields full confidentiality, integrity, and availability impact. Reported by Patchstack; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 27.1%.
Unauthenticated account takeover in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows any remote attacker to forge a cart-recovery token and force WordPress to authenticate them as an arbitrary user, including administrators, via wp_set_auth_cookie(). The flaw combines MAC-free AES-CTR token encryption with a keystream-recovery attack, an HMAC nonce check that is skipped entirely when the wcap_nonce parameter is omitted, and a missing ownership check between the decrypted abandoned_id and the attacker-supplied user_email. Exploitation requires the attacker to have one legitimate cart-recovery link of their own plus a victim who has previously abandoned a cart, and because the auto-login feature is enabled by default and force-enabled on upgrade, default installations are exposed; no public exploit code has been identified at time of analysis, but the assessed risk is high and no CISA KEV entry is associated with this issue.
Unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows remote attackers to extract sensitive information from a WordPress site's database by forging the plugin's encrypted 'validate' parameter. The parameter is protected with AES-CTR, a malleable stream cipher, so an attacker who abandons a cart using an email address they control can harvest one legitimate token, recover the keystream, and re-encrypt arbitrary SQL; the HMAC integrity check introduced in 10.4.1 is enforced only when the wcap_nonce parameter is present, and omitting that parameter skips the check entirely. CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting unauthenticated, remote, confidentiality-only impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the attack requires only a token-harvest and keystream-recovery step rather than a one-shot injection.
Unauthenticated SQL injection in the Abandoned Cart Pro for WooCommerce plugin (≤10.8.0) allows remote attackers to execute arbitrary SQL commands via attacker-controlled guest checkout fields, leading to database information disclosure and modification of WordPress user metadata. Exploitation can escalate an arbitrary account to administrator by injecting a malicious wp_capabilities row, and the vulnerability is exploitable without authentication or user interaction (CVSS 9.8). No public exploit code has been identified at time of analysis, but the flaw is considered high-priority due to its severe impact and default exposure on public-facing stores with the vulnerable guest cart persistence feature enabled.
Privilege escalation in the Abandoned Cart Pro for WooCommerce WordPress plugin (all versions through 10.7.1) allows authenticated subscribers to gain full WordPress administrative access by hijacking the plugin's SMTP email routing. Missing capability checks and nonce verification on at least four AJAX endpoints - including wcap_save_connector_settings - permit any subscriber-level user to silently redirect outbound SMTP traffic through an attacker-controlled mail server. Once SMTP is redirected, the attacker intercepts auto-login recovery links sent to administrators and authenticates as admin without any further credentials. No public exploit has been identified at time of analysis, but the attack exploits a default-enabled feature, significantly lowering the bar for abuse on any standard installation.
Privilege escalation in Abandoned Cart Pro for WooCommerce (Tyche Softwares) affects all versions up to and including 10.4.0, allowing an unauthenticated remote attacker to gain elevated privileges over a WordPress site. The CVSS 3.1 vector (AV:N/PR:N/UI:N) with a 9.8 score indicates the flaw is reachable over the network without credentials or user interaction, and yields full confidentiality, integrity, and availability impact. Reported by Patchstack; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 27.1%.