8.1
High
CVE-2026-12585 The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its…
Description
The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Abandoned Cart Lite for WooCommerce 6.8 | earliest → < 6.8.2 | 6.8.2 |