CVE-2026-12585
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Abandoned Cart Lite for WooCommerce WordPress plugin before version 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account. This allows unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.
Risk Assessment
The risk is the potential takeover of any user account without knowing their password, which can lead to data theft, unauthorized purchases, or privilege escalation within the WooCommerce store.
Recommendation
Immediately update the Abandoned Cart Lite for WooCommerce plugin to version 6.8.2 or later. If an update is not possible, temporarily disable the automatic login option in the plugin settings.
Other vulnerabilities in Abandoned Cart Lite for WooCommerce
See all- CVE-2026-65557Medium
The Abandoned Cart Lite for WooCommerce plugin version 6.8.0 and earlier contains a Cross-Site Scripting (XSS) vulnerability for users with the Shop Manager role. A Shop Manager can inject malicious scripts.
- CVE-2026-57637Medium
Unauthenticated Cross Site Request Forgery (CSRF) vulnerability in Abandoned Cart Lite for WooCommerce versions up to 6.8.0. An attacker can trick an administrator into performing unintended actions without their knowledge.
Original NVD description (English source)
The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.