CVE-2026-97668: Abandoned Cart Pro for WooCommerce Unauthenticated SQL Injection

Overview

A critical, pre-authentication SQL injection vulnerability has been disclosed in Abandoned Cart Pro for WooCommerce, a commercial cart-recovery plugin from Tyche Softwares used on a large number of WooCommerce storefronts. Tracked as CVE-2026-97668 and assigned a maximum-severity CVSS 9.8, the flaw lives in the guest-cart "persistent" tracking path and lets a completely unauthenticated attacker inject arbitrary SQL into an UPDATE statement against WordPress's wp_usermeta table.

Exploitation requires no account, no nonce, and no user interaction — only an HTTP request to the plugin's guest-cart tracking endpoint during normal WooCommerce checkout flow. Researchers have demonstrated that the injection can be escalated beyond data theft into a full administrator account takeover, making this one of the more severe WooCommerce plugin disclosures of the year.

Wordfence is the assigning CNA. The CVE was reserved 2026-09-24 and published 2026-10-14.

Technical Details

How It Works

Abandoned Cart Pro tracks carts for guest (not-logged-in) shoppers so it can send recovery emails later. That tracking is handled by the plugin's update_guest_persistent_cart() function, which periodically writes a serialized blob of cart state — the abandoned_cart_info value — back into the database.

The root cause is a classic "prepared statements some of the time" bug:

• The adjacent SELECT (to check whether a guest-cart row already exists) and INSERT (to create a new row) both use prepared statements correctly.
• The UPDATE branch — taken when a persistent guest-cart row already exists — concatenates abandoned_cart_info directly into the SQL string instead of binding it as a parameter.

abandoned_cart_info is built from attacker-controlled checkout form fields, including fields such as an SMS-consent/opt-in checkbox value that the plugin captures during the guest checkout flow. Before use, the value is passed through PHP's stripslashes() — which removes escaping backslashes rather than adding any — and the result is then dropped straight into the UPDATE ... SET clause with no $wpdb->prepare() call and no manual escaping.

Because the vulnerable statement targets wp_usermeta, an attacker who controls the injected SQL can:

• Use time-based blind SQL injection techniques to exfiltrate arbitrary data from the WordPress database (password hashes, API keys, PII, session tokens, etc.), since the injection point is in an UPDATE, not a SELECT, so content cannot be reflected directly and must be inferred via timing.
• Write additional rows into wp_usermeta for an attacker-chosen user_id — most critically, forging a wp_capabilities meta row. Because WordPress resolves a user's role from whichever wp_capabilities row is read, an attacker-written row can shadow the legitimate one and grant that account full administrator capabilities, with no password reset, no email, and no admin approval step involved.

The entire chain runs pre-authentication: a guest checkout session is sufficient to reach update_guest_persistent_cart().

Impact Assessment

Who Is At Risk

Any WooCommerce store running Abandoned Cart Pro for WooCommerce ≤ 10.8.0 with the plugin's guest-cart tracking active (the default configuration) is exposed, including:

• Storefronts that allow guest checkout (the overwhelming majority of WooCommerce sites)
• Multi-admin WooCommerce installs where an elevated account is a high-value target
• Sites that store payment-adjacent or customer PII in wp_usermeta or related tables reachable from the same database user

Potential Attack Chains

1. Unauthenticated Reconnaissance — Attacker submits crafted checkout-field data (e.g. the SMS-consent field) to trigger update_guest_persistent_cart() and confirm the injection is reachable.
2. Blind Data Exfiltration — Time-based blind SQL injection techniques extract user credentials, API keys, or other sensitive wp_usermeta/wp_users data without ever seeing query output directly.
3. Capability Forgery — Attacker crafts a payload that writes a wp_capabilities row for a chosen user_id, elevating that account (including a freshly self-registered one, where registration is open) to Administrator.
4. Full Site Takeover — With an administrator session, the attacker installs a malicious plugin or theme file, achieving remote code execution on the underlying server and full compromise of the site and any co-hosted data.

Mitigation

Immediate Actions

• Update Abandoned Cart Pro for WooCommerce to the version in which Tyche Softwares patches CVE-2026-97668 as soon as it is released; track the vendor's changelog closely given the severity.
• If no patch is yet available, consider temporarily disabling the plugin's guest-cart persistent-tracking feature, or disabling guest checkout entirely, to remove the reachable code path.
• Audit wp_usermeta for unexpected wp_capabilities rows, especially any account that was not deliberately promoted to Administrator by a trusted operator.
• Rotate credentials for any administrator accounts if compromise is suspected, and review the WordPress user list for unfamiliar accounts.

Detection Opportunities

• Web server / WAF logs showing unusually long or malformed values in checkout POST fields (particularly SMS-consent or other optional checkout fields) submitted outside a normal browser checkout flow
• Database query logs (if enabled) showing UPDATE statements against wp_usermeta with SQL metacharacters or timing-function calls (e.g. SLEEP(), BENCHMARK()) embedded in the value
• New or modified wp_capabilities rows appearing without a corresponding admin-panel role-change action in the audit log
• Unexpected new Administrator accounts, or existing low-privilege accounts suddenly gaining admin capabilities

Defence-in-Depth

• Run a Web Application Firewall capable of generic SQL injection signature detection in front of WooCommerce checkout endpoints
• Apply the principle of least privilege to the WordPress database user where feasible, limiting blast radius from a successful injection
• Keep WooCommerce core, PHP, and all commerce-adjacent plugins patched and monitored — abandoned-cart and marketing-automation plugins are a common target because they intentionally process pre-authentication, attacker-supplied data
• Maintain tested, offline backups and a rollback plan in case of confirmed administrator-account compromise

Background

This is the second critical, unauthenticated vulnerability disclosed in Abandoned Cart Pro for WooCommerce in the same release window. CVE-2026-97657, also rated CVSS 9.8, is a related — but technically distinct — authentication-bypass flaw in the plugin's cart-recovery auto-login feature (malleable AES-CTR encryption combined with a bypassable HMAC check), which separately allows unauthenticated attackers to forge valid auto-login tokens and take over arbitrary accounts, including administrators. Both issues were reserved within days of each other and published the same day, underscoring that this plugin's pre-authentication, guest-facing attack surface has received concentrated security research attention and should be treated as a priority patch target independent of which specific CVE a given installation is tracking.

References

• NVD — CVE-2026-97668
• Wordfence Intelligence — Abandoned Cart plugin family
• Strix.ai — CVE-2026-97668 analysis