CVE-2026-97657 Tyche Softwares CVE debrief

Who should care

Defenders of WordPress installations using the Abandoned Cart Pro for WooCommerce plugin, especially those with versions up to and including 10.8.0, should be aware of this vulnerability and take immediate action to update the plugin. This vulnerability could allow unauthenticated attackers to potentially take over user accounts, including administrators.

Why it matters

CVE-2026-97657 is a critical vulnerability in the Abandoned Cart Pro for WooCommerce plugin for WordPress, allowing unauthenticated authentication bypass via malleable encryption and bypassable HMAC in cart-recovery link tokens. Defenders should prioritize updating the plugin to prevent potential account takeovers.

• Potential for full account takeover of any user who has ever abandoned a cart, including administrators
• Unauthenticated attackers can recover the keystream and forge ciphertext to decrypt to any victim's cart ID
• Trigger a call to wp_set_auth_cookie() for the victim user, achieving full account takeover

Technical summary

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied user_email GET parameter — combined with an HMAC nonce check in wcap_email_track_links() that is only enforced when the wcap_nonce parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted abandoned_id with no ownership verification confirming the cart belongs to the email used for decryption.

Defensive priority

High priority should be given to updating the Abandoned Cart Pro for WooCommerce plugin to a version beyond 10.8.0, as the current version is vulnerable to authentication bypass.

Recommended defensive actions

• Update Abandoned Cart Pro for WooCommerce to a version beyond 10.8.0
• Review user accounts for potential unauthorized access
• Monitor for suspicious activity related to cart-recovery links
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability exists in Abandoned Cart Pro for WooCommerce versions up to and including 10.8.0. It allows unauthenticated attackers to bypass authentication via malleable encryption and bypassable HMAC in cart-recovery link tokens.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.