CVE-2026-97657

9.8 CRITICAL

Published 2026-10-14 · Updated 2026-10-14

AI risk analysis

Summary: The Abandoned Cart Pro plugin has a critical authentication bypass vulnerability due to insecure encryption and HMAC handling that allows attackers to forge cart recovery links and take over any user's account, including administrators.
Exploitability: Exploitation is straightforward for attackers who have access to a legitimate cart recovery link, requiring only the ability to construct forged ciphertexts and omit the nonce parameter to bypass authentication checks.
Blast radius: The vulnerability affects all installations where the auto-login feature is enabled (which is default), potentially compromising any user account that has ever abandoned a cart, including high-privilege administrator accounts.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to version 10.8.1 or later which contains the fix for this authentication bypass vulnerability.

auth-bypasswoocommercewp-plugincart-recovery

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-639

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.