Authentication Bypass in Abandoned Cart Pro for WooCommerce

CVE-2026-97657 is a critical authentication bypass vulnerability affecting Tyche Softwares Abandoned Cart Pro for WooCommerce, versions 10.8.0 and earlier. The flaw exists in the plugin's implementation of recovery links, which utilize an insecure MAC-free AES-CTR encryption scheme. Because the integrity-verifying wcap_nonce parameter is only validated when present, an attacker can omit it to bypass integrity checks. By acquiring a single legitimate recovery URL, an attacker can use XOR-malleation to modify the CTR ciphertext, replacing their own cart ID with a victim's abandoned cart ID. When the manipulated link is requested, the plugin decrypts the altered token, loads the victim's account identifier, and triggers wp_set_auth_cookie() to automatically log the attacker in as the victim, including users with administrative privileges. This exploit is highly dangerous due to the ease of automation and the high-privilege outcome.

Attack Chain

1. Attacker obtains a legitimate abandoned cart recovery URL (e.g., via checkout_link or track_links) for their own controlled email address.
2. Attacker parses the recovery URL to extract the ciphertext from the validate parameter.
3. Attacker identifies the target victim's abandoned cart ID (e.g., from public metadata or site enumeration).
4. Attacker performs XOR-malleation on the CTR ciphertext to change the embedded cart ID from their source ID to the victim's target ID.
5. Attacker reconstructs the forged URL, ensuring the wcap_nonce or wcal_nonce parameter is removed.
6. Attacker sends an unauthenticated HTTP GET request to the forged URL.
7. The server decrypts the manipulated token and uses the victim's associated user_id to initialize the session.
8. The server invokes wp_set_auth_cookie(), granting the attacker an authenticated session as the victim.

Impact

Successful exploitation results in full account takeover of any registered WordPress user who has an abandoned cart, including administrative accounts. This permits unauthorized access to sensitive customer data, site management capabilities, and potentially further malicious activities such as malware deployment or site defacement. The vulnerability is rated CVSS 9.8 (Critical).

Recommendation

• Immediately upgrade Abandoned Cart Pro for WooCommerce to a version released after 10.8.0.
• Disable the auto-login feature within the plugin settings if an immediate patch is not possible to prevent wp_set_auth_cookie() execution.
• Audit web server logs for requests to recovery endpoints (wacp_action=checkout_link or wcal_action=track_links) that lack the expected wcap_nonce or wcal_nonce parameters.
• Review audit logs for unexpected account authentications originating from recovery link click-throughs.