Key points
- Versions up to 10.8.0 of Abandoned Cart Pro are vulnerable to authentication bypass via malleable encryption.
- The flaw allows unauthenticated attackers to take over any user account, including administrators, without credentials.
- No patch or version update has been confirmed to fix this critical vulnerability yet.
The Abandoned Cart Pro plugin for WooCommerce contains a critical authentication bypass flaw affecting all versions up to and including 10.8.0. According to the National Vulnerability Database, the issue stems from how the plugin handles cart-recovery link tokens. Attackers can exploit this to take over any user account on an affected site. The auto-login feature is enabled by default and forced on during upgrades, meaning most installations are immediately exploitable without any additional configuration changes.
In plain English
The plugin uses a weak encryption method for its recovery links. It relies on AES-CTR encryption without a message authentication code to verify data integrity. The encryption key is selected using an email address supplied by the attacker in a URL parameter. This allows an attacker to manipulate the encryption process. They can forge tokens that decrypt to any user's cart ID, effectively impersonating any user who has abandoned a cart.
The background
The vulnerability is classified as CVE-2026-97657 with a CVSS score of 9.8, rated as critical. The National Vulnerability Database describes the weakness as CWE-639. The flaw involves a bypassable HMAC check that is only enforced if a specific parameter is present. Attackers can simply omit this parameter to skip the check entirely. There is also no verification that the decrypted cart ID belongs to the email address used for decryption, allowing universal account takeover.
What changes now
Security teams must recognize that this flaw affects the core authentication mechanism of the plugin. An attacker needs only one legitimate cart-recovery link to recover the keystream. Once the keystream is known, they can forge ciphertext for any victim. This triggers a call to set an authentication cookie for the victim user. Consequently, any user who has ever abandoned a cart is at risk of full account takeover, including site administrators.
Who needs to act first
Teams should immediately assess which systems run the Abandoned Cart Pro plugin. Prioritize sites with public-facing e-commerce functionality and high-value user data. If the plugin cannot be removed immediately, restrict access to the cart-recovery endpoints using web application firewalls or IP allow-lists. Monitor server logs for unusual authentication patterns or repeated failed recovery attempts. Ensure that backup systems are isolated from the production environment to prevent lateral movement if an account is compromised.
Background: Authentication bypass vulnerabilities
Enforce server-side session validation for every request. Use short-lived tokens with strict scope. Implement multi-factor authentication to block credential theft. Remove client-side logic that makes access decisions. Audit your code for logic flaws that skip verification steps.
Read the full guide: Stop Authentication Bypass Vulnerabilities with Priority Controls
What to do and how to stay safe: Abandoned Cart Pro
- Remove the Abandoned Cart Pro plugin immediately if it is not critical to current operations.
- Monitor server logs for suspicious activity related to cart recovery links or authentication cookies.
- Implement web application firewall rules to block requests with manipulated encryption parameters.
- Wait for the vendor to release a patched version before reinstalling the plugin.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Abandoned Cart Pro are affected?
All versions up to and including 10.8.0 are vulnerable to this authentication bypass flaw.
Is there a patch available for CVE-2026-97657?
No patch or fix has been confirmed yet according to the source material.
Can unauthenticated attackers exploit this vulnerability?
Yes, unauthenticated attackers can exploit this flaw to take over any user account on the site.
