Key points
- Versions up to 10.8.0 of Abandoned Cart Pro are vulnerable to CVE-2026-97657.
- The flaw allows unauthenticated attackers to forge tokens and take over accounts.
- No fix has been confirmed yet; the auto-login feature is enabled by default.
Tyche Softwares Abandoned Cart Pro for WooCommerce contains a critical authentication bypass affecting versions up to 10.8.0. Security researchers have identified that attackers can hijack any user account, including administrators, by exploiting flaws in how the plugin handles cart-recovery tokens.
What happened
The National Vulnerability Database records CVE-2026-97657 as a critical issue with a CVSS score of 9.8. The vulnerability stems from malleable encryption and a bypassable HMAC check within the plugin’s code. According to the NVD record, the plugin uses MAC-free AES-CTR encryption for generating cart-recovery link tokens. This method carries an eight-byte counter nonce inside the ciphertext blob itself.
The encryption key lookup relies on a user-supplied email parameter provided via the GET request. The NVD description notes that this design allows attackers to manipulate the decryption process. Furthermore, the HMAC nonce verification in the `wcap_email_track_links` function is only enforced when a specific parameter is present. Attackers can bypass this check completely by omitting the parameter from their request.
An insecure direct object reference also exists in the handling of the decrypted cart identifier. The system fails to verify that the recovered cart actually belongs to the email address used for decryption. This lack of ownership verification enables an attacker to target any cart ID, regardless of the associated user.
Why it matters
An unauthenticated attacker needs only a single legitimate cart-recovery link to exploit this flaw. According to the source material, obtaining one such link from their own reminder email is sufficient. With this link, the attacker can recover the keystream used for encryption. They can then forge a new ciphertext that decrypts to any victim’s cart identifier.
This forged token triggers a call to the WordPress authentication function for the target user. The result is a full account takeover for any user who has previously abandoned a cart. This includes high-privilege accounts such as site administrators. The NVD record states that the auto-login feature defaults to enabled in the plugin.
The vulnerability is present in all affected installations by default. The plugin forces the auto-login feature on during upgrades, meaning no additional configuration is required for the flaw to be exploitable. Consequently, every installation running version 10.8.0 or lower is considered at risk without further mitigation.
What happens next
Security teams must assess their WordPress environments for the presence of the Abandoned Cart Pro plugin. They should check the installed version against the affected range ending at 10.8.0. If the plugin is present, immediate isolation or removal may be necessary until a patch is available.
Teams should monitor for unusual login activity, particularly from accounts that have not recently abandoned carts. Reviewing server logs for requests containing the specific parameters mentioned in the vulnerability description can help identify exploitation attempts. Administrators should also verify if any other plugins share similar encryption or token-handling patterns.
Patch priority
Teams usually prioritise systems with public-facing e-commerce functionality first. Check whether the plugin is active on production stores before staging environments. Back up the database and file system before attempting any manual code changes or plugin removals. Test any temporary mitigations in a non-production environment to ensure they do not break legitimate checkout flows. Reduce exposure by restricting access to the recovery endpoints if possible, though this may impact user experience.
What to do and how to stay safe: Abandoned Cart Pro
- Audit all WordPress installations for the Abandoned Cart Pro plugin and identify those running version 10.8.0 or lower.
- Monitor authentication logs for suspicious login events that do not correspond to recent user activity or cart abandonment.
- Review plugin configurations to see if the auto-login feature can be disabled manually, although the source indicates it is forced on during upgrades.
- Prepare a contingency plan to remove or replace the plugin if a patch is not provided promptly by the vendor.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Abandoned Cart Pro are affected?
All versions up to and including 10.8.0 are vulnerable to CVE-2026-97657.
Is there a patch available for this vulnerability?
No fix has been confirmed yet according to the source material.
What is the severity of CVE-2026-97657?
The NVD rates the vulnerability as critical with a CVSS score of 9.8.
