Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97668— Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value

Quick assessment

Affected
Tyche Softwares Abandoned Cart Pro for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Abandoned Cart Pro for WooCommerce 插件在所有 10.8.0 及以下版本中存在 SQL 注入漏洞。该漏洞源于 函数对用户输入数据缺乏充分的转义处理，并且在构造现有 SQL 查询时未使用足够安全的参数化准备语句。 具体而言， 字段的值来自攻击者可控的结账字段（例如短信同意选项），经过 处理后，被直接拼接进一个 UPDATE 语句中；而相邻的 SELECT 和 INSERT 操作则使用了预准备语句（prepared statements）。这种不一致的处理方式使

CVSS 9.8 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97668

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value
Source: CVE Program / CVE List V5
Vulnerability Description
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Tyche Softwares Abandoned Cart Pro for WooCommerce 0 ~ 10.8.0 -

II. Public POCs for CVE-2026-97668

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97668

请登录查看更多情报信息。

Other References for CVE-2026-97668 (1)

Same Patch Batch · Tyche Softwares · 2026-10-14 · 3 CVEs total

CVE-2026-97657 9.8 CRITICAL Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via M
CVE-2026-102251 7.5 HIGH Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR C

IV. Related Vulnerabilities

Same product: Abandoned Cart Pro for WooCommerce
Same vendor: Tyche Softwares
Same weakness: CWE-89

V. Comments for CVE-2026-97668

No comments yet

Leave a comment