External risk intelligence

Abandoned Cart Pro Authentication Bypass Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-97657

The vulnerability affects a WordPress plugin used for e-commerce, which is designed to be public-facing to interact with customers. The plugin's functionality, including the auto-login feature, is active by default in standard deployments, exposing the vulnerable endpoint directly to the public internet for any visitor or attacker to access without authentication.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in a popular e-commerce plugin for WordPress, potentially allowing unauthenticated attackers to take over any user account, including administrators. The issue stems from weaknesses in how the plugin handles encryption and authentication for cart recovery links. The auto-login feature, enabled by default, significantly increases the risk by forcing these actions on plugin upgrades.

Unauthorized account takeover possible.
Affects public-facing e-commerce sites.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by exploiting how the Abandoned Cart Pro for WooCommerce plugin handles cart recovery links. By obtaining a legitimate recovery link and manipulating it with the victim's email, an attacker can decrypt information and forge a token to gain access to any user's account, including administrators, as the auto-login feature is enabled by default.

No authentication needed to start.
Trigger by sending crafted recovery link.
Full account takeover risk.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with a legitimate cart-recovery link could potentially take over any user's account on a WordPress site using the Abandoned Cart Pro for WooCommerce plugin. This is because the plugin's encryption and authentication mechanisms can be bypassed, allowing an attacker to forge a recovery link for any user and log in as them, including administrators. The auto-login feature being enabled by default in affected installations means that successful exploitation is possible without further configuration.

User accounts, including administrator privileges.
Forging recovery links through encryption bypass.
Complete account takeover of any user.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Abandoned Cart Pro for WooCommerce plugin exposes e-commerce sites to account takeover by unauthenticated attackers. The exploit bypasses authentication through insecure encryption and HMAC checks, allowing attackers to take over any user account, including administrators, by forging cart recovery links. Given the plugin's public-facing nature and default auto-login settings, immediate triage is essential to assess exposure and plan remediation.

Ownership: E-commerce platform administrators and plugin managers.
Verify first: Identify all WooCommerce sites using the plugin.
Action: Plan vendor coordinated updates or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Abandoned Cart Pro for WooCommerce plugin?

It is a WordPress extension designed for e-commerce sites to help store owners recover lost sales. It works by sending automated reminder emails to customers who add items to their cart but do not complete the checkout process, typically providing a direct link for them to return and finish their purchase.

What does CVE-2026-97657 mean for site security?

This vulnerability is classified as an Insecure Direct Object Reference (CWE-639). It means the plugin fails to properly verify if a user actually owns the cart they are trying to access. Because of flawed encryption and missing integrity checks, an attacker can manipulate links to gain unauthorized access to any user's account, including administrators.

How is this authentication bypass triggered?

An attacker triggers this by crafting a manipulated cart-recovery URL. Because the plugin does not verify ownership of the cart ID or enforce security checks when certain parameters are omitted, the attacker can use a single legitimate link to forge credentials for any user. It does not require special administrative access to initiate, as the system defaults to an auto-login mode.

Do I need to worry if my site uses this plugin?

According to Halo Surface Signal, this is highly relevant because the plugin is designed for public-facing e-commerce. Because the problematic auto-login feature is enabled by default in affected versions, the vulnerable endpoint is exposed directly to the internet, making it accessible to any visitor or external actor without needing prior authentication.

What should I do first to address this?

Start by identifying all WordPress sites in your environment that have this specific plugin installed. Since the vulnerability is active by default, prioritize these installations for immediate review. Consult the vendor's documentation for official updates to secure your configuration and prevent unauthorized account access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.