Key points
- CVE-2026-97657 allows full account takeover via malleable encryption flaws.
- The vulnerability affects Abandoned Cart Pro versions up to and including 10.8.0.
- Attackers need only one legitimate recovery link to compromise any user account.
Unauthenticated attackers can seize control of any WordPress user account, including site administrators, by exploiting a critical flaw in the Abandoned Cart Pro plugin. According to the National Vulnerability Database, this vulnerability, tracked as CVE-2026-97657, carries a CVSS score of 9.8 and enables complete authentication bypass through manipulated encryption tokens.
The exploit relies on the plugin’s handling of cart-recovery links. An attacker needs only a single legitimate recovery email, which they can obtain by triggering it themselves. With that one token, they can recover the encryption keystream and forge new ciphertexts that decrypt to any victim’s cart ID, effectively impersonating any user who has abandoned a cart.
Technical mechanics of the bypass
The plugin uses MAC-free AES-CTR encryption for its tokens, carrying the nonce inside the ciphertext blob. The encryption key is selected using an attacker-supplied email parameter, while the HMAC check can be skipped by omitting the nonce parameter entirely. Furthermore, the system fails to verify that the decrypted cart ID belongs to the email used for decryption, allowing direct object reference attacks to succeed without ownership checks.
Scope of affected installations
The vulnerability impacts all versions of Tyche Softwares’ Abandoned Cart Pro for WooCommerce up to and including 10.8.0. The auto-login feature, which facilitates the account takeover, defaults to enabled and is forced on during plugin upgrades. This means every affected installation is exploitable by default, requiring no additional configuration changes from the site administrator to make the site vulnerable to this specific attack vector.
What happens next
Security teams should immediately audit their WordPress installations for the presence of the Abandoned Cart Pro plugin. If installed, verify the version number against the affected range. Monitor authentication logs for unusual activity, such as login events from unexpected IP addresses or for users who have not recently interacted with the site. The source material does not confirm the availability of a fix, so teams should wait for vendor guidance before assuming an update exists.
Why this attack works
This incident illustrates the dangers of rolling-code ciphers without integrity protection. When encryption lacks a message authentication code, attackers can manipulate ciphertext to alter decrypted content. Combined with logic flaws that skip validation steps, such as missing HMAC checks or absent ownership verification, these weaknesses allow threat actors to forge valid tokens. Teams usually see this pattern when cryptographic primitives are used incorrectly or when convenience features bypass standard security controls.
Background: Authentication bypass vulnerabilities
Authentication bypass flaws rarely stem from weak passwords. They typically arise from logic errors in how applications process identity tokens, session states or internal trust boundaries. Misconceptions about where these vulnerabilities hide lead teams to overlook critical server-side validation gaps and trust assumptions that attackers exploit to gain unauthorised access.
Read the full guide: Authentication Bypass Myths: What Security Teams Get Wrong
What to do and how to stay safe: Abandoned Cart Pro
- Identify if the Abandoned Cart Pro plugin is installed on any WordPress sites within your infrastructure.
- Check the current version against the affected range up to 10.8.0.
- Monitor for anomalous authentication events that may indicate token forgery.
- Review plugin configurations to see if auto-login features can be disabled pending a vendor update.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-97657?
The National Vulnerability Database rates the severity as 9.8, which is classified as critical.
Which versions of Abandoned Cart Pro are vulnerable?
All versions up to and including 10.8.0 are affected by this authentication bypass flaw.
Does the attacker need to be logged in to exploit this?
No, the attack can be performed by unauthenticated attackers who possess a single legitimate cart-recovery link.
