Is CVE-2026-57637 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57637 being exploited in the wild.

How severe is CVE-2026-57637?

Medium severity, with a CVSS score of 4.3, published 26 June 2026.

Is there a fix for CVE-2026-57637?

A patch was published on 2026-06-26: Version 6.8.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57637 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57637?

Check whether you run Tyche Softwares Abandoned Cart Lite for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57637: Tyche Softwares Abandoned Cart Lite for WooCommerce CSRF

CVE-2026-57637 · Severity: medium · CVSS 4.3 · Published 2026-06-26

Abandoned Cart Lite for WooCommerce, a WordPress plugin used to recover lost sales by tracking unfinished checkouts, is vulnerable to a security flaw that could allow an attacker to trick an administrator into performing unintended actions. By persuading a logged-in site manager to click a malicious link, an attacker could potentially modify plugin settings or data without authorization. This could disrupt store operations or lead to unauthorized changes in how the store handles abandoned customer carts.

Technologies: Tyche Softwares Abandoned Cart Lite for WooCommerce. Vendors: Tyche Softwares.

Quick answers

Is CVE-2026-57637 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57637 being exploited in the wild.
How severe is CVE-2026-57637?: Medium severity, with a CVSS score of 4.3, published 26 June 2026.
Which products and versions are affected?: Tyche Softwares Abandoned Cart Lite for WooCommerce <= 6.8.0.
Is there a fix for CVE-2026-57637?: A patch was published on 2026-06-26: Version 6.8.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57637 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57637?: Check whether you run Tyche Softwares Abandoned Cart Lite for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Abandoned Cart Lite for WooCommerce plugin for WordPress due to insufficient nonce validation on sensitive actions. The flaw affects versions up to and including 6.8.0. An unauthenticated remote attacker can exploit this by crafting a malicious request and tricking a site administrator into executing it while authenticated (e.g., via social engineering or a malicious link). Successful exploitation allows the attacker to perform actions on behalf of the administrator, such as modifying plugin configurations. The issue is resolved in version 6.8.1.

Affected products

Tyche Softwares Abandoned Cart Lite for WooCommerce <= 6.8.0

Timeline

2026-06-09: disclosed: Reported by Ananda Dhakal via Patchstack
2026-06-26: advisory: Public advisory published by Patchstack and NVD
2026-06-26: patched: Version 6.8.1 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.