CVE-2026-102251

Name of the Vulnerable Software and Affected Versions Abandoned Cart Pro for WooCommerce versions prior to 10.8.1

Description Unauthenticated attackers can perform a generic SQL Injection by manipulating the validate parameter. This is caused by insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. Attackers can exploit the malleability of the AES-CTR stream cipher—a type of encryption where the ciphertext can be modified to produce a predictable change in the plaintext—to recover the keystream and forge ciphertexts containing arbitrary SQL. Additionally, the HMAC check, which is a mechanism used to verify the integrity and authenticity of data, is only enforced when the wcap nonce parameter is present; omitting this parameter allows the check to be bypassed.

Recommendations Update Abandoned Cart Pro for WooCommerce to version 10.8.1 or later. As a temporary mitigation, restrict access to the functionality utilizing the validate parameter.