CVE-2026-97668 Tyche Softwares CVE debrief

Who should care

WooCommerce site administrators, security teams, and developers using the Abandoned Cart Pro for WooCommerce plugin should assess exposure and apply necessary patches or mitigations.

Why it matters

CVE-2026-97668 is a critical SQL injection vulnerability in the Abandoned Cart Pro for WooCommerce plugin, allowing unauthenticated attackers to extract sensitive information and modify database rows. It affects versions up to 10.8.0 and requires immediate attention from WooCommerce site administrators and security teams.

• Potential extraction of sensitive information from the database via time-based blind techniques.
• Modification of usermeta rows, potentially leading to privilege escalation.
• Possible disruption of WooCommerce functionality due to unauthorized database modifications.
• Requires verification of patch application and monitoring for potential SQL injection attempts.

Technical summary

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0. The vulnerability exists due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. This allows unauthenticated attackers to append additional SQL to queries, enabling extraction of sensitive information via time-based blind techniques and modification of usermeta rows. It has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one, highlighting the need for Woo

Defensive priority

High priority for WooCommerce site administrators and security teams to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure by checking if the Abandoned Cart Pro for WooCommerce plugin version is 10.8.0 or earlier.
• Apply patches or updates provided by the vendor to vulnerable versions.
• Implement additional monitoring and logging to detect potential SQL injection attempts.
• Review and restrict access to sensitive data and administrative functions.
• Verify patch application and monitor for potential SQL injection attempts.
• Conduct a thorough review of database records for any unauthorized modifications.
• Update asset inventory to reflect systems that have been patched or mitigated.

Evidence notes

The vulnerability allows unauthenticated attackers to append additional SQL to queries, enabling extraction of sensitive information via time-based blind techniques and modification of usermeta rows. It has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.