# CVE-2026-56010: Tyche Softwares Abandoned Cart Pro for WooCommerce privilege escalation

Source: https://junglewise.ai/threats/cve-2026-56010-tyche-softwares-abandoned-cart-pro-for-woocommerce-privilege  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-56010 · Severity: high · CVSS 8.8 · Published 2026-06-26

Abandoned Cart Pro for WooCommerce, a WordPress plugin used to recover lost sales by tracking unfinished checkouts, contains a security flaw that allows low-privileged users to increase their own permissions. An attacker with a basic 'Subscriber' account could exploit this to gain administrative control over the website. This could lead to full site takeover, theft of customer data, or disruption of store operations.

Technologies: [Tyche Softwares Abandoned Cart Pro for WooCommerce](https://junglewise.ai/threats/technologies/abandoned-cart-pro-for-woocommerce). Vendors: [Tyche Softwares](https://junglewise.ai/threats/vendors/tyche-softwares).

## Quick answers

**Is CVE-2026-56010 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56010 being exploited in the wild.

**How severe is CVE-2026-56010?** High severity, with a CVSS score of 8.8, published 26 June 2026.

**Which products and versions are affected?** Tyche Softwares Abandoned Cart Pro for WooCommerce <= 10.4.0.

**Is there a fix for CVE-2026-56010?** A patch was published on 2026-06-26: NVD published date and patch availability confirmed in 10.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56010 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56010?** Check whether you run Tyche Softwares Abandoned Cart Pro for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in the Abandoned Cart Pro for WooCommerce plugin for WordPress due to incorrect privilege assignment (CWE-266). The flaw allows an authenticated attacker with Subscriber-level permissions to escalate their privileges to a higher level, potentially gaining full administrative access to the WordPress site. The vulnerability is reachable over the network and does not require user interaction. The issue is resolved in version 10.4.1.

## Affected products

- Tyche Softwares Abandoned Cart Pro for WooCommerce <= 10.4.0

## Timeline

- 2026-05-15: disclosed: Reported by Austin Ginder
- 2026-06-19: advisory: Patchstack published advisory
- 2026-06-26: patched: NVD published date and patch availability confirmed in 10.4.1

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/woocommerce-abandon-cart-pro/vulnerability/wordpress-abandoned-cart-pro-for-woocommerce-plugin-10-4-0-privilege-escalation-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/woocommerce-abandon-cart-pro/vulnerability/wordpress-abandoned-cart-pro-for-woocommerce-plugin-10-4-0-privilege-escalation-vulnerability?_s_id=cve)

## Related threats

- [Abandoned Cart Pro for WooCommerce SQL injection in validate parameter](https://junglewise.ai/threats/cve-2026-102251-the-abandoned-cart-pro-for-woocommerce-plugin-for-wordpress-is)
- [Abandoned Cart Pro for WooCommerce privilege escalation via missing AJAX capability checks](https://junglewise.ai/threats/cve-2026-81543-abandoned-cart-pro-for-woocommerce-privilege-escalation-via)