Woocommerce Abandon Cart Pro Vulnerabilities

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_...

CVSS:

9.8

(Wordfence)

Affected:

up to 10.8.0

Fixed in:

10.8.1

Disclosed:

Oct 13, 2026

CVE-2026-97668 on NVD →

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

CVSS:

7.5

(Wordfence)

Affected:

up to 10.8.0

Fixed in:

10.8.1

Disclosed:

Oct 13, 2026

CVE-2026-102251 on NVD →

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside...

CVSS:

9.8

(Wordfence)

Affected:

up to 10.8.0

Fixed in:

10.8.1

Disclosed:

Oct 13, 2026

CVE-2026-97657 on NVD →

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_inf...

CVSS:

8.8

(Wordfence)

Affected:

up to 10.7.1

Fixed in:

10.7.2

Disclosed:

Sep 4, 2026

CVE-2026-81543 on NVD →

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.4.0. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for unauthenticated attackers to elevate their privileges beyond...

CVSS:

7.3

(Wordfence)

Affected:

up to 10.4.0

Fix:

No patched version reported

Disclosed:

Aug 20, 2026

CVE-2026-66682 on NVD →

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.

CVSS:

8.8

(Wordfence)

Affected:

up to 10.4.0

Fixed in:

10.4.1

Disclosed:

Jun 19, 2026

CVE-2026-56010 on NVD →

The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level ac...

CVSS:

8.8

(Wordfence)

Affected:

up to 9.16.0

Fixed in:

9.17.0

Disclosed:

Jun 9, 2025

CVE-2025-4387 on NVD →