Attack Chain

1. Attacker obtains a legitimate abandoned cart recovery URL (e.g., via checkout_link or track_links) for their own controlled email address.
2. Attacker parses the recovery URL to extract the ciphertext from the validate parameter.
3. Attacker identifies the target victim's abandoned cart ID (e.g., from public metadata or site enumeration).
4. Attacker performs XOR-malleation on the CTR ciphertext to change the embedded cart ID from their source ID to the victim's target ID.
5. Attacker reconstructs the forged URL, ensuring the wcap_nonce or wcal_nonce parameter is removed.
6. Attacker sends an unauthenticated HTTP GET request to the forged URL.
7. The server decrypts the manipulated token and uses the victim's associated user_id to initialize the session.
8. The server invokes wp_set_auth_cookie(), granting the attacker an authenticated session as the victim.

Impact

Successful exploitation results in full account takeover of any registered WordPress user who has an abandoned cart, including administrative accounts. This permits unauthorized access to sensitive customer data, site management capabilities, and potentially further malicious activities such as malware deployment or site defacement. The vulnerability is rated CVSS 9.8 (Critical).

Recommendation

• Immediately upgrade Abandoned Cart Pro for WooCommerce to a version released after 10.8.0.
• Disable the auto-login feature within the plugin settings if an immediate patch is not possible to prevent wp_set_auth_cookie() execution.
• Audit web server logs for requests to recovery endpoints (wacp_action=checkout_link or wcal_action=track_links) that lack the expected wcap_nonce or wcal_nonce parameters.
• Review audit logs for unexpected account authentications originating from recovery link click-throughs.