CVE-2026-97657

Name of the Vulnerable Software and Affected Versions Abandoned Cart Pro for WooCommerce versions prior to 10.8.1

Description An authentication bypass exists due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens. The 8-byte CTR nonce is stored within the ciphertext blob, and the encryption key is retrieved using the attacker-supplied user email GET parameter. Additionally, the HMAC nonce check in the wcap email track links() function is only enforced if the wcap nonce parameter is not empty, allowing it to be bypassed by omitting the parameter. An insecure direct object reference on the decrypted abandoned id further allows access without ownership verification. An unauthenticated attacker with a legitimate cart-recovery link can recover the keystream, forge a ciphertext for any victim's cart ID, and trigger wp set auth cookie() to achieve full account takeover of any user who abandoned a cart, including administrators. The auto-login feature is enabled by default and forced during upgrades.

Recommendations Update Abandoned Cart Pro for WooCommerce to version 10.8.1 or later.