CVE-2026-97657 in Abandoned Cart Pro Plugin
Summary
by MITRE • 10/14/2026
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Abandoned Cart Pro for WooCommerce versions up to 10.8.0 represents a critical failure in authentication mechanisms driven by flawed cryptographic implementation and insufficient access control logic. The core technical flaw stems from the use of AES-CTR encryption without an accompanying Message Authentication Code, commonly referred to as MAC-free encryption. In this specific implementation, cart-recovery link tokens are encrypted using AES-CTR mode, where the initialization vector or nonce is embedded directly within the ciphertext blob rather than being transmitted separately or protected by integrity checks. This design choice creates a malleable cipher text environment because CTR mode transforms into a stream cipher that allows for bitwise manipulation of the plaintext without detection if no authentication tag is present. An attacker who intercepts a valid encrypted token can modify specific bits in the ciphertext, which will result in corresponding predictable changes to the decrypted output, effectively allowing them to alter the underlying data structure of the cart identifier without needing the encryption key.
The exploitation path is further facilitated by how the decryption key is retrieved and validated within the application logic. The system looks up the AES encryption key using a user-supplied email address provided via the `user_email` GET parameter, rather than deriving it from a secure session or server-side state that cannot be easily manipulated. This allows an attacker to specify any arbitrary email address during the decryption process. More critically, the integrity check mechanism implemented in the `wcap_email_track_links()` function relies on an HMAC nonce validation that is conditionally enforced only when the `wcap_nonce` parameter is present and non-empty. By omitting this parameter entirely, an attacker can bypass the nonce verification step completely. This logical flaw means that even if some form of integrity checking existed in other code paths, it is effectively disabled for requests where the nonce field is absent, creating a straightforward path to bypass security controls through parameter omission rather than complex cryptographic breaking.
Once the encryption and authentication checks are circumvented, the vulnerability manifests as an Insecure Direct Object Reference combined with a complete lack of ownership verification on the decrypted `abandoned_id`. The application assumes that if a valid cart ID is produced by the decryption process, it belongs to the user associated with the email address used for key lookup. There is no secondary validation step to confirm that the abandoned cart identified in the token actually corresponds to the account being targeted or authorized. This oversight allows an attacker who possesses only one legitimate cart-recovery link from their own reminder email to perform a keystream recovery attack. By analyzing the known plaintext of their own cart data within the encrypted blob, they can derive parts of the encryption key stream and then forge new ciphertexts that decrypt into any other user's abandoned cart ID.
The operational impact of this vulnerability is severe, resulting in full account takeover for any user who has ever used the plugin to abandon a shopping cart, including high-privilege users such as administrators. The forged token triggers an auto-login feature via `wp_set_auth_cookie()`, which authenticates the attacker as the victim without requiring valid credentials. This auto-login functionality is enabled by default and is forcibly activated during plugin upgrades, ensuring that all affected installations are vulnerable regardless of specific configuration choices made after initial installation. An unauthenticated remote attacker can exploit this over HTTP or HTTPS to gain persistent access to a victim's WordPress dashboard, potentially leading to data exfiltration, defacement, further lateral movement within the network, and complete compromise of the e-commerce platform's integrity and availability.
From a standards perspective, this vulnerability aligns with CWE-287 for Improper Authentication due to the failure to correctly verify user identity before granting access, and CWE-345 for Insufficient Verification of Data Authenticity regarding the lack of cryptographic integrity checks on the encrypted tokens. The exploitation technique involving malleable ciphertext manipulation corresponds to CWE-691, while the reliance on a predictable or exposed key derivation method relates to CWE-798 for Use of Hard-coded Credentials if keys are static, though here it is more accurately described as improper key management via user-supplied inputs. In terms of MITRE ATT&CK mapping, this falls under T1078 Valid Accounts and specifically the sub-technique of using default or weak credentials through automated account takeover mechanisms. The attack vector leverages client-side manipulation to bypass server-side security controls, highlighting a critical misalignment between assumed trust in input parameters and actual enforcement of identity verification protocols within the application logic.
Mitigation strategies must address both the cryptographic weaknesses and the logical flaws in access control. Immediate remediation involves upgrading to a patched version of Abandoned Cart Pro that implements authenticated encryption such as AES-GCM or adds an HMAC layer to verify ciphertext integrity before decryption proceeds. Developers should ensure that nonce values are generated securely, transmitted separately from the ciphertext, and validated unconditionally regardless of parameter presence. Furthermore, strict ownership verification must be implemented at every stage where user-specific data is accessed; the system must explicitly validate that the decrypted cart ID belongs to the authenticated session or requested account before proceeding with any action like auto-login. Until patches are applied, administrators should consider disabling the auto-login feature if possible and monitoring for unusual authentication patterns originating from unexpected IP addresses or geographic locations associated with abandoned cart recovery links.