CVE-2026-97668

Summary

The Abandoned Cart Pro plugin has a SQL injection vulnerability in its update_guest_persistent_cart() function that allows unauthenticated attackers to inject malicious SQL into UPDATE statements targeting the wp_usermeta table, potentially extracting data and escalating privileges to administrator level.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and leverages user-supplied checkout fields that bypass normal input sanitization, with the attacker needing only to submit specific data through the cart functionality.

Blast radius

The vulnerability affects all installations up to version 10.8.0, potentially allowing attackers to gain full administrative control over WordPress sites using this plugin, which could lead to complete compromise of affected websites and their user data.

Detection

Monitor for unusual UPDATE queries against wp_usermeta table with time-based SQL injection patterns, particularly those involving guest cart data from checkout fields, and watch for suspicious usermeta updates that could indicate privilege escalation attempts.

Prioritized remediation

Upgrade to version 10.8.1 or later immediately, as this is the first fixed release addressing the SQL injection vulnerability in the Abandoned Cart Pro plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.