{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-97657/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tychesoftwares:abandoned_cart_pro_for_woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-97657"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Abandoned Cart Pro for WooCommerce (\u003c= 10.8.0)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","web-application","wordpress","cve-2026-97657"],"_cs_type":"advisory","_cs_vendors":["Tyche Softwares"],"content_html":"\u003cp\u003eCVE-2026-97657 is a critical authentication bypass vulnerability affecting Tyche Softwares Abandoned Cart Pro for WooCommerce, versions 10.8.0 and earlier. The flaw exists in the plugin's implementation of recovery links, which utilize an insecure MAC-free AES-CTR encryption scheme. Because the integrity-verifying \u003ccode\u003ewcap_nonce\u003c/code\u003e parameter is only validated when present, an attacker can omit it to bypass integrity checks. By acquiring a single legitimate recovery URL, an attacker can use XOR-malleation to modify the CTR ciphertext, replacing their own cart ID with a victim's abandoned cart ID. When the manipulated link is requested, the plugin decrypts the altered token, loads the victim's account identifier, and triggers \u003ccode\u003ewp_set_auth_cookie()\u003c/code\u003e to automatically log the attacker in as the victim, including users with administrative privileges. This exploit is highly dangerous due to the ease of automation and the high-privilege outcome.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains a legitimate abandoned cart recovery URL (e.g., via \u003ccode\u003echeckout_link\u003c/code\u003e or \u003ccode\u003etrack_links\u003c/code\u003e) for their own controlled email address.\u003c/li\u003e\n\u003cli\u003eAttacker parses the recovery URL to extract the ciphertext from the \u003ccode\u003evalidate\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the target victim's abandoned cart ID (e.g., from public metadata or site enumeration).\u003c/li\u003e\n\u003cli\u003eAttacker performs XOR-malleation on the CTR ciphertext to change the embedded cart ID from their source ID to the victim's target ID.\u003c/li\u003e\n\u003cli\u003eAttacker reconstructs the forged URL, ensuring the \u003ccode\u003ewcap_nonce\u003c/code\u003e or \u003ccode\u003ewcal_nonce\u003c/code\u003e parameter is removed.\u003c/li\u003e\n\u003cli\u003eAttacker sends an unauthenticated HTTP GET request to the forged URL.\u003c/li\u003e\n\u003cli\u003eThe server decrypts the manipulated token and uses the victim's associated \u003ccode\u003euser_id\u003c/code\u003e to initialize the session.\u003c/li\u003e\n\u003cli\u003eThe server invokes \u003ccode\u003ewp_set_auth_cookie()\u003c/code\u003e, granting the attacker an authenticated session as the victim.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full account takeover of any registered WordPress user who has an abandoned cart, including administrative accounts. This permits unauthorized access to sensitive customer data, site management capabilities, and potentially further malicious activities such as malware deployment or site defacement. The vulnerability is rated CVSS 9.8 (Critical).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade Abandoned Cart Pro for WooCommerce to a version released after 10.8.0.\u003c/li\u003e\n\u003cli\u003eDisable the auto-login feature within the plugin settings if an immediate patch is not possible to prevent \u003ccode\u003ewp_set_auth_cookie()\u003c/code\u003e execution.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for requests to recovery endpoints (\u003ccode\u003ewacp_action=checkout_link\u003c/code\u003e or \u003ccode\u003ewcal_action=track_links\u003c/code\u003e) that lack the expected \u003ccode\u003ewcap_nonce\u003c/code\u003e or \u003ccode\u003ewcal_nonce\u003c/code\u003e parameters.\u003c/li\u003e\n\u003cli\u003eReview audit logs for unexpected account authentications originating from recovery link click-throughs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T12:48:09Z","date_published":"2026-10-14T12:48:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-97657/","summary":"An unauthenticated authentication bypass vulnerability (CVE-2026-97657) in Abandoned Cart Pro for WooCommerce versions 10.8.0 and earlier allows attackers to perform account takeovers via XOR-malleation of recovery tokens.","title":"Authentication Bypass in Abandoned Cart Pro for WooCommerce","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-97657/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-97657","version":"https://jsonfeed.org/version/1.1"}