Executive brief
Abandoned Cart Pro is a WordPress plugin that recovers lost sales by sending automated cart reminder emails to customers. The plugin suffers from a privilege escalation flaw that allows low-privileged subscribers to modify email routing settings and intercept admin login links, gaining full administrative control. This is possible because the auto-login feature is enabled by default and the plugin fails to validate user permissions on critical settings changes.
Technical details
The vulnerability is a privilege escalation caused by missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. Authenticated attackers with subscriber-level access can exploit this to modify SMTP connector settings, redirecting administrator recovery emails to attacker-controlled servers. By intercepting auto-login links in diverted emails, attackers gain full administrative access. The attack requires only network access and valid subscriber credentials; the auto-login feature is enabled by default. Patches are available in version 10.8.0 and later.
Affected products
- Tyche Softwares Abandoned Cart Pro for WooCommerce up to and including 10.7.1
Timeline
- 2026-09-05: disclosed