Privilege Escalation in Abandoned Cart Pro for WooCommerce

The Abandoned Cart Pro for WooCommerce plugin for WordPress, developed by Tyche Softwares, contains a critical privilege escalation vulnerability (CVE-2026-81543) affecting all versions up to and including 10.7.1. The flaw stems from missing capability checks and nonce verification within several AJAX actions, specifically wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data.

An attacker with authenticated subscriber-level access can exploit these deficiencies to modify SMTP connector settings. By redirecting outgoing administrative emails through an attacker-controlled server, the actor can intercept account recovery emails and auto-login links. If the plugin's default auto-login feature is active, this allows the attacker to gain full administrative privileges on the WordPress site. Defenders should note that this vulnerability requires an authenticated session and targets the plugin's default email management functions.

Impact

Successful exploitation allows a subscriber-level user to escalate privileges to a full administrator account. This grants the attacker complete control over the WordPress installation, enabling them to install malicious plugins, exfiltrate customer databases, or modify site content. The vulnerability impacts all users of the affected plugin versions.

Recommendation

• Update the Abandoned Cart Pro for WooCommerce plugin to the latest version (or the version containing the fix provided by Tyche Softwares) immediately.
• Audit existing SMTP connector settings in the plugin for any unauthorized or unfamiliar external mail relay configurations.
• Monitor WordPress access logs for high-frequency or unauthorized calls to the identified AJAX action endpoints from users without administrative roles.
• Disable the auto-login feature within the plugin settings until a patch is applied to mitigate the risk of account hijacking via intercepted links.