CVE-2026-97657— Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
Quick assessment
Affected
Tyche Softwares Abandoned Cart Pro for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 WooCommerce 插件“Abandoned Cart Pro”在所有不高于 10.8.0 的版本中存在安全漏洞，该漏洞允许通过可操纵的加密机制和可绕过的 HMAC（基于消息验证码的哈希消息认证码）实现身份验证绕过。 漏洞成因如下： 1. 用于购物车恢复链接令牌的加密采用无 MAC（消息验证码）保护的 AES-CTR 模式。其中，8 字节的 CTR 非随机数（nonce）嵌入在密文数据块内，而加密密钥是通过攻击者提供的 GET 参数进行查找的。 2. 在 函数中，存在一个对 HMAC 非
In-the-Wild Activity Observed
github_trending · low
Possible ATT&CK Techniques 3 AI
T1110.003 · Password Spraying T1190 · Exploit Public-Facing Application T1528 · Steal Application Access TokenAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Tyche Softwares | Abandoned Cart Pro for WooCommerce | ≤ 10.8.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97657
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Tyche Softwares | Abandoned Cart Pro for WooCommerce | 0 ~ 10.8.0 | - |
|
II. Public POCs for CVE-2026-97657
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97657
请登录查看更多情报信息。
Other References for CVE-2026-97657 (1)
Same Patch Batch · Tyche Softwares · 2026-10-14 · 3 CVEs total
| CVE-2026-97668 | 9.8 CRITICAL | Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Per |
| CVE-2026-102251 | 7.5 HIGH | Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR C |
IV. Related Vulnerabilities
Same product: Abandoned Cart Pro for WooCommerce
-
CVE-2026-102251
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticat -
CVE-2026-97668
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticat -
CVE-2026-81543
Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Autho -
CVE-2026-66682
WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4. -
CVE-2026-56010
WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.
Same vendor: Tyche Softwares
-
CVE-2026-102251
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticat -
CVE-2026-97668
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticat -
CVE-2026-81543
Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Autho -
CVE-2023-52210
WordPress Product Delivery Date for WooCommerce – Lite plugi -
CVE-2025-4387
Abandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated
Same weakness: CWE-639
-
CVE-2026-103525
FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct -
CVE-2026-89280
Dokan: AI Powered WooCommerce Multivendor Marketplace Soluti -
CVE-2026-111368
ClassroomIO through 1.0.0 IDOR via Course Submission Update, -
CVE-2026-111366
cool-admin-midway through 8.0.0 Authorization Bypass via /ad -
CVE-2026-111365
cool-admin-midway through 8.0.0 Missing Authorization via Sy
V. Comments for CVE-2026-97657
No comments yet