Cart Abandonment Recovery for WooCommerce CVE Debriefs

Cart Abandonment Recovery for WooCommerce CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Cart Abandonment Recovery for WooCommerce CVE published 2026-10-14

CVE-2026-96900

The Cart Abandonment Recovery for WooCommerce plugin before version 2.1.4 is vulnerable to unauthorized abandoned cart record deletion and modification via an insecure direct object reference (IDOR). An unauthenticated attacker who knows a customer's email can destroy or tamper with that customer's stored abandoned-cart data. This vulnerability allows attackers to delete or modify abandoned cart records, [truncated]