Skip to content
Sign in
8.8 High

CVE-2026-81543 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,…

Description

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.

Affected products and versions

Product Affected versions Fixed in
Abandoned Cart Pro for WooCommerce 10.7 earliest → 10.7.1 No fix stated

Other CVEs of Abandoned Cart Pro for WooCommerce

The 5 CVEs of Abandoned Cart Pro for WooCommerce →
CVE-2026-102251 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate'… 7.5 High CVE-2026-97657 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable… 9.8 Critical CVE-2026-97668 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent… 9.8 Critical CVE-2025-4387 The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to… 8.8 High
Track this CVE