CVE-2026-97657: Abandoned Cart Pro for WooCommerce Authentication Bypass

Overview

A critical authentication bypass vulnerability has been disclosed in Abandoned Cart Pro for WooCommerce, a commercial plugin by Tyche Softwares used to email customers recovery links for carts they abandoned before checkout. Tracked as CVE-2026-97657 (CVSS 9.8, Critical), the flaw allows an unauthenticated remote attacker to forge the encrypted token embedded in a cart-recovery link and trigger the plugin's auto-login feature as any other user on the site — including administrators.

The root cause is a combination of three design failures in the token scheme: MAC-free AES-CTR encryption that is malleable by design, an HMAC nonce check that is only enforced when the attacker chooses to supply it, and a missing ownership check between the decrypted cart ID and the email used to decrypt it. Because the plugin's auto-login feature ships enabled by default and is re-enabled on upgrade, every default installation running an affected version is exploitable with no additional configuration.

Technical Details

How It Works

Abandoned Cart Pro generates a cart-recovery link containing an encrypted token that identifies which cart — and therefore which customer — the link belongs to. The plugin's wcap_email_track_links() handler decrypts that token and, if it validates, calls wp_set_auth_cookie() to log the visitor in as the associated user. Three separate weaknesses combine to break this scheme:

1. Malleable encryption with no MAC. The token is encrypted with AES in CTR mode, a stream cipher mode with no built-in integrity protection. CTR mode XORs plaintext with a keystream, which means an attacker who can predict or recover the keystream can flip arbitrary bits of the ciphertext and produce a different, still-valid-looking plaintext on decryption — without ever knowing the encryption key. Making matters worse, the 8-byte CTR nonce is carried inside the ciphertext blob itself, and the decryption key is looked up using the attacker-supplied user_email GET parameter — handing the attacker control over both inputs needed to reconstruct the keystream from a single legitimate recovery link (such as one generated for the attacker's own abandoned cart).
2. An HMAC check that can simply be omitted. The plugin does include a nonce/HMAC verification step intended to catch tampered tokens, but it is implemented as "validate the nonce if one was provided" rather than "reject the request if a valid nonce is absent." An attacker who sends the forged link without the wcap_nonce parameter skips the integrity check entirely.
3. No ownership verification on the decrypted ID. Even if the ciphertext forgery succeeds, a well-built system would still confirm that the decrypted abandoned_id actually belongs to the user_email supplied. Abandoned Cart Pro performs no such check, so a forged token that decrypts to a different cart's ID is accepted as valid — an insecure direct object reference (IDOR) layered on top of the broken crypto.

Chained together, an attacker with one legitimate cart-recovery link (trivially obtained by abandoning a cart on the target site themselves) can recover enough keystream material to forge a ciphertext that decrypts to any victim's cart ID, strip the nonce parameter to bypass the HMAC check, and have the plugin call wp_set_auth_cookie() on their behalf — logging the attacker in as that victim. Since any user who has ever abandoned a cart is a potential target, and site administrators routinely test checkout flows, this reliably extends to full administrator takeover. A public proof-of-concept exploit implementing this XOR-malleation attack is already circulating.

Impact Assessment

Who Is At Risk

Any WooCommerce store running Abandoned Cart Pro for WooCommerce ≤ 10.8.0 with the auto-login feature active — which is the default state — is vulnerable. This includes:

• Stores using the plugin's standard abandoned-cart email reminders with one-click recovery links
• Multi-admin WooCommerce deployments, where an abandoned test cart by an administrator becomes a path to full admin takeover
• Agencies and managed WooCommerce hosts running the plugin across multiple client sites without centralized patch tracking

Potential Attack Chains

1. Token Acquisition — Attacker abandons a cart on the target store to receive their own legitimate, correctly-signed recovery link
2. Keystream Recovery — Attacker uses the known plaintext/ciphertext pair from their own token to recover the AES-CTR keystream
3. Ciphertext Forgery — Attacker XORs the keystream against a target abandoned_id/email pair to produce a forged token for a victim account
4. Integrity Check Bypass — Attacker submits the forged link with the wcap_nonce parameter omitted, skipping HMAC validation entirely
5. Account Takeover — The plugin decrypts the forged token, finds no ownership mismatch is checked, and calls wp_set_auth_cookie(), authenticating the attacker as the victim — up to and including a site administrator
6. Post-Takeover Abuse — From an administrator session: install a malicious plugin/theme for persistent RCE, exfiltrate customer PII and order data, or pivot to payment-gateway credentials stored in WooCommerce settings

Mitigation

Immediate Actions

• Update to Abandoned Cart Pro for WooCommerce 10.8.1 or later immediately — this release replaces the MAC-free AES-CTR scheme, closes the HMAC-omission bypass, and adds ownership verification on the decrypted cart ID
• If immediate patching isn't possible, disable the auto-login feature in the plugin's settings to remove the wp_set_auth_cookie() call entirely as a stopgap
• Force a password reset and active session invalidation for all administrator and high-privilege accounts if the site has been running an affected version with auto-login enabled
• Review the Users list for unexpected new administrator accounts and audit recently installed plugins/themes for signs of post-takeover persistence

Detection Opportunities

• Review web server / WAF logs for requests to cart-recovery or wcap_email_track_links endpoints that are missing a wcap_nonce parameter — a strong indicator of exploitation attempts
• Look for recovery-link requests carrying a user_email parameter that doesn't match the abandoned_id on record, or repeated requests cycling through different abandoned_id/email combinations from the same source IP
• Audit WordPress login/auth-cookie events for logins attributed to the auto-login feature that don't correlate with a genuine abandoned-cart email send
• Watch for new administrator account creation or plugin/theme installation immediately following an unexplained admin-level login

Defence-in-Depth

• Apply the principle of least privilege to WooCommerce admin accounts and enforce MFA on all administrator logins regardless of plugin-level auth flows
• Keep WooCommerce extensions on a tracked patch cadence — commercial plugins like this one often ship security fixes without a correspondingly loud public announcement
• Deploy a WAF rule set tuned for WordPress/WooCommerce that can flag anomalous parameter patterns (e.g., auth-sensitive requests missing expected security tokens)
• Maintain offline, tested backups of the WooCommerce database and uploads directory in case recovery from an administrator-level compromise is required

Background

The WooCommerce plugin ecosystem is one of the largest attack surfaces in the WordPress world: tens of thousands of extensions, many handling authentication, payments, or customer PII, with wildly varying levels of security maturity between vendors. Abandoned Cart Pro's own history illustrates the pattern — this is not the first authentication-adjacent flaw in the Tyche Softwares cart-recovery line (the free "Lite" edition suffered a related authentication bypass via insufficient token encryption in 2023), and a separate privilege-escalation issue in the same Pro plugin, affecting versions up to 10.7.1, was disclosed only weeks earlier. Any plugin that implements its own authentication shortcut — auto-login links chief among them — deserves extra scrutiny, since a single cryptographic misstep in that code path tends to translate directly into full account takeover rather than a contained bug.

References

• NVD — CVE-2026-97657
• Wordfence Threat Intelligence — Abandoned Cart Pro for WooCommerce Vulnerabilities
• Tyche Softwares — Abandoned Cart Pro for WooCommerce
• Tyche Softwares — Abandoned Cart Pro Changelog