CVE-2026-97668 is a critical (CVSS 9.8) unauthenticated SQL injection in the Abandoned Cart Pro for WooCommerce plugin for WordPress, in all versions up to and including 10.8.0. It can be used to take over an account with administrator rights.
What Is It
The vulnerability (CWE-89) is in the plugin's update_guest_persistent_cart() function. It is reached through the guest cart persistent meta_value. The abandoned_cart_info value is filled from checkout fields the attacker controls, such as the SMS consent field. That value goes through stripslashes() and is then pasted directly into an UPDATE statement. The SELECT and INSERT statements next to it use prepared statements, but this UPDATE does not. Because escaping and query preparation are insufficient, an unauthenticated attacker can add their own SQL to the query.
Why It Matters
The injected SQL lands in an UPDATE ... SET on the wp_usermeta table, which gives an attacker two options:
- Data theft: pull sensitive information out of the database using time-based blind techniques.
- Account takeover: change usermeta rows. The NVD description says this has been demonstrated to make any account an administrator by writing a
wp_capabilitiesrow that shadows the real one.
The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) means it can be exploited over the network with low complexity, no privileges and no user interaction. Confidentiality, integrity and availability impact are all rated High.
CVE-2026-97668 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so there is no KEV confirmation of active exploitation and no CISA-mandated required action. The NVD record has status "Received" and was published October 14, 2026.
What's Vulnerable
- Vendor: Tyche Softwares
- Product: Abandoned Cart Pro for WooCommerce (WordPress plugin)
- Affected versions: all versions up to and including 10.8.0
The record lists no CPEs.
Patch Status
The supplied source material does not name a fixed version. Anyone running 10.8.0 or earlier should check the Tyche Softwares changelog and the Wordfence advisory for a patched release and update as soon as one is confirmed. The bug needs no authentication and can lead to administrator takeover, so if no fix is available, consider disabling the plugin until one is.