CVE-2026-97668 in Abandoned Cart Pro for WooCommerce Plugin
Summary
by MITRE • 10/14/2026
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The Abandoned Cart Pro for WooCommerce plugin, widely deployed within WordPress e-commerce environments up to version 10.8.0, contains a critical SQL injection vulnerability rooted in inconsistent data handling practices across its codebase. The flaw resides specifically within the update_guest_persistent_cart function, where user-supplied input is processed with insufficient sanitization and escaping mechanisms. Unlike other parts of the plugin that correctly utilize prepared statements for SELECT and INSERT operations to mitigate injection risks, this specific UPDATE statement concatenates attacker-controlled data directly into the SQL query string. This architectural inconsistency creates a significant attack surface, allowing malicious actors to inject arbitrary SQL commands by manipulating input fields such as SMS consent options during the checkout process. The vulnerability is particularly severe because it does not require authentication, enabling unauthenticated remote attackers to exploit the flaw from any location with network access to the target WordPress instance.
The technical mechanism of this exploitation involves the manipulation of the guest cart persistent meta_value field. When a user interacts with specific checkout fields that are stored as abandoned cart information, the plugin applies stripslashes() to remove backslashes but fails to properly escape or parameterize the resulting string before embedding it into an UPDATE SQL statement targeting the wp_usermeta table. This lack of preparation allows attackers to terminate the intended query and append malicious payloads. Because the sink is a database update operation rather than a simple data retrieval, the impact extends beyond mere information disclosure. Attackers can leverage time-based blind techniques to extract sensitive data from the underlying MySQL database by observing response delays or conditional logic outcomes. This capability effectively turns the plugin into a conduit for comprehensive database enumeration and exfiltration of stored credentials, customer personal identifiable information, and other proprietary business data held within the WordPress user metadata tables.
Beyond data extraction, this vulnerability poses an immediate and critical threat to system integrity through privilege escalation. By crafting specific SQL injection payloads, attackers can modify existing rows in the wp_usermeta table or insert new ones that shadow legitimate entries. Specifically, it has been demonstrated that an attacker can write a wp_capabilities row with administrator-level permissions for any user account ID they control or target. This action effectively grants full administrative access to the WordPress dashboard without requiring valid credentials for that specific role. Once elevated privileges are obtained, attackers can install malicious plugins, modify core files, deface websites, or use the compromised server as a pivot point for further attacks against internal networks. The ability to escalate arbitrary accounts underscores the severity of this flaw, transforming what might otherwise be an information disclosure issue into a complete system compromise scenario.
From a classification perspective, this vulnerability aligns with CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. It also maps to MITRE ATT&CK techniques related to Database Query Hijacking and Credential Access via Stored Credentials or Account Manipulation. The specific method of shadowing legitimate capability rows corresponds to lateral movement and persistence tactics where attackers establish long-term access by modifying existing user attributes rather than creating new accounts that might be more easily detected by security monitoring tools. This approach allows the malicious activity to blend in with normal administrative changes, potentially evading basic anomaly detection systems for extended periods.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The primary and most effective mitigation is to upgrade the Abandoned Cart Pro plugin to a version later than 10.8.0, where the developer has presumably corrected the input handling in the update_guest_persistent_cart function by implementing proper prepared statements or rigorous escaping functions such as $wpdb->prepare(). For organizations unable to patch immediately due to compatibility constraints, temporary mitigations include restricting access to WordPress admin endpoints via IP whitelisting and deploying a Web Application Firewall configured with rules specifically targeting SQL injection patterns within POST requests related to WooCommerce checkout processes. Additionally, database-level monitoring should be enhanced to detect unusual UPDATE operations on the wp_usermeta table, particularly those involving capability modifications or unexpected data structures in meta_value fields. Regular audits of plugin code for consistent use of prepared statements across all database interactions are essential to prevent similar vulnerabilities from arising in other components of the WordPress ecosystem.