A critical (CVSS 9.8) authentication bypass in the Abandoned Cart Pro for WooCommerce plugin for WordPress can let an unauthenticated attacker forge cart-recovery links. If auto-login is enabled, the attacker can then log in as a user who has an abandoned-cart record in the plugin. Administrators are affected too if they have such a record.
What Is It
CVE-2026-97657 is an authentication bypass in Tyche Softwares' Abandoned Cart Pro for WooCommerce plugin, caused by malleable encryption and an HMAC check that can be skipped. Wordfence reported it, and NVD published it on 2026-10-14. Three flaws combine to cause it:
- Encryption without a MAC: Cart-recovery link tokens use AES-CTR with no message authentication. The 8-byte CTR nonce travels inside the ciphertext, and the plugin looks up the encryption key using the
user_emailGET parameter, which the attacker controls. - HMAC check skipped when empty: The nonce check in
wcap_email_track_links()only runs when thewcap_nonceparameter is non-empty. An attacker bypasses it by leaving the parameter out. - Insecure direct object reference (CWE-639): The plugin never checks that the decrypted
abandoned_idbelongs to the email used for decryption.
Why It Matters
An attacker only needs one legitimate cart-recovery link, such as one from their own reminder email. With it, they can recover the keystream and forge a ciphertext that decrypts to another user's abandoned-cart ID. The plugin then calls wp_set_auth_cookie() for that user, which gives the attacker full control of the account. The likely targets are accounts that have an abandoned-cart record the plugin is tracking. That can include administrator accounts, but only if an administrator has such a record.
Auto-login is enabled by default and forced on during plugin upgrades. Most affected installations are therefore likely exploitable without extra configuration, unless an administrator has turned auto-login off since the last upgrade. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network-reachable, low complexity, and no privileges or user interaction needed.
Exploitation status: CVE-2026-97657 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog data supplied for this brief, so KEV does not confirm active exploitation.
What's Vulnerable
- Vendor: Tyche Softwares
- Product: Abandoned Cart Pro for WooCommerce (WordPress plugin)
- Affected versions: All versions up to and including 10.8.0
Patch Status
The source data lists every version through 10.8.0 as affected but does not name a fixed release. No CISA required action applies because the CVE is not in KEV. Administrators running 10.8.0 or earlier should:
- check the vendor changelog and the Wordfence advisory below for a patched version, and upgrade as soon as one is available
- treat the auto-login feature as an exposure until the plugin is patched
NVD status is "Received," so the record may still change.