CVE-2026-81543 in Abandoned Cart Pro Plugin
Summary
by MITRE • 09/05/2026
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/05/2026
The Abandoned Cart Pro for WooCommerce plugin contains a critical privilege escalation vulnerability affecting all versions up to 10.7.1. This flaw stems from insufficient validation of user permissions and lack of cryptographic verification on several AJAX endpoints within the plugin's codebase. Specifically, the actions wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data fail to enforce proper capability checks or verify nonces before processing requests. This architectural deficiency allows any authenticated user with subscriber-level access or higher to manipulate sensitive configuration settings without authorization from an administrator.
The primary technical impact of this vulnerability is the ability for low-privileged users to alter SMTP connector configurations. By modifying these settings, attackers can redirect administrative recovery emails and auto-login links to a server under their control. This capability effectively bypasses standard authentication mechanisms because WordPress relies on email-based password resets and secure login tokens that are now intercepted by the attacker. The exploitability of this flaw is significantly heightened by the plugin's default configuration, which enables the auto-login feature. Consequently, an attacker can trigger these automated processes to receive credentials or session tokens intended for high-privilege accounts.
From a security classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-352 Cross-Site Request Forgery due to the missing nonce verification. In terms of attack vectors, it corresponds to MITRE ATT&CK techniques such as T1078 Valid Accounts for initial access via compromised low-level credentials and T1556 Modifying Authentication Process by intercepting recovery mechanisms. The exploitation chain typically involves an attacker gaining subscriber or lower-level access through social engineering or other means, followed by crafting malicious AJAX requests to reconfigure email routing settings.
The operational impact is severe, as it leads to full administrative takeover of the WordPress installation. Once the attacker receives the intercepted auto-login link or recovery credentials, they can assume complete control over the website's backend. This grants access to all stored customer data, financial information processed by WooCommerce, and the ability to install further malicious plugins or modify site code. The breach compromises not only the integrity of the web application but also the confidentiality and availability of associated business operations dependent on that platform.
Mitigation strategies should prioritize immediate updates to version 10.7.2 or later where these checks have been implemented by the developers. For sites unable to update immediately, administrators can disable the auto-login feature within the plugin settings if accessible via existing administrative interfaces. Additionally, implementing strict input validation and enforcing nonce verification on all AJAX endpoints is essential for hardening against similar vulnerabilities in other plugins. Regular auditing of user capabilities and monitoring SMTP logs for unusual routing changes can also help detect exploitation attempts early.