Cart Abandonment Recovery For Woocommerce
Monthly
Unauthenticated remote attackers can delete or overwrite stored abandoned-cart records in the WordPress plugin Cart Abandonment Recovery for WooCommerce (all versions before 2.1.4) by supplying a customer's email address, which the plugin uses as the record key without verifying that the requester owns that address (CWE-639, CVSS 5.3). Exploitation requires only a known or guessable email per target record, so the attacker cannot mass-wipe blindly without an email list, and the impact is confined to abandoned-cart data - no passwords, orders, or payment details are exposed given C:N/I:L and SSVC technical impact of partial. No confirmed active exploitation has been reported (not in CISA KEV), but publicly available exploit code exists per WPScan and EPSS is 0.17% (5th percentile), indicating a genuine yet low real-world risk that is fully resolved by upgrading to 2.1.4.
Unauthenticated remote attackers can delete or overwrite stored abandoned-cart records in the WordPress plugin Cart Abandonment Recovery for WooCommerce (all versions before 2.1.4) by supplying a customer's email address, which the plugin uses as the record key without verifying that the requester owns that address (CWE-639, CVSS 5.3). Exploitation requires only a known or guessable email per target record, so the attacker cannot mass-wipe blindly without an email list, and the impact is confined to abandoned-cart data - no passwords, orders, or payment details are exposed given C:N/I:L and SSVC technical impact of partial. No confirmed active exploitation has been reported (not in CISA KEV), but publicly available exploit code exists per WPScan and EPSS is 0.17% (5th percentile), indicating a genuine yet low real-world risk that is fully resolved by upgrading to 2.1.4.