Cpe:2.3:a:tychesoftwares:abandoned_cart_pro_for_woocommerce:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3atychesoftwaresabandoned_cart_pro_for_woocommercewordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 14 Oct 2026 04:35:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection in Abandoned Cart Pro for WooCommerce Pluginhttps://feed.craftedsignal.io/briefs/2026-10-sql-injection-woocommerce-plugin/Wed, 14 Oct 2026 04:35:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-sql-injection-woocommerce-plugin/An unauthenticated SQL injection vulnerability in the Abandoned Cart Pro for WooCommerce plugin allows attackers to exfiltrate data or escalate privileges to administrator by modifying user metadata.The Abandoned Cart Pro for WooCommerce plugin for WordPress (versions up to and including 10.8.0) contains a critical SQL injection vulnerability in the update_guest_persistent_cart() function. The flaw stems from improper handling of the 'abandoned_cart_info' parameter, which is extracted from user-supplied checkout fields like SMS consent. While other parts of the SQL query use prepared statements, the affected UPDATE statement concatenates the meta_value directly after only basic stripslashes() sanitization. This allows unauthenticated attackers to append arbitrary SQL commands. The vulnerability is highly impactful as it targets the wp_usermeta table, enabling attackers to perform time-based blind SQL injection for data exfiltration or to manipulate user privileges by injecting malicious wp_capabilities rows, effectively elevating an arbitrary account to administrator status.

Impact

Successful exploitation allows unauthenticated attackers to compromise the integrity and confidentiality of the WordPress database. Attackers can extract sensitive information or grant themselves administrative access, leading to full site takeover. The scope of impact includes any WordPress installation running the vulnerable Abandoned Cart Pro plugin version 10.8.0 or lower.

Recommendation

  • Upgrade the Abandoned Cart Pro for WooCommerce plugin to the latest version immediately to patch CVE-2026-97668.
  • Review database audit logs for anomalous modifications to the wp_usermeta table, specifically looking for unexpected 'wp_capabilities' entries.
  • Implement a Web Application Firewall (WAF) rule to block common SQL injection patterns in HTTP POST requests targeting WordPress checkout-related endpoints.
  • Audit user accounts for unauthorized administrator roles granted during the incident timeframe.
]]>criticaladvisory