CVE-2026-57637
MediumCVSS 4.3Summary
Unauthenticated Cross Site Request Forgery (CSRF) vulnerability in Abandoned Cart Lite for WooCommerce versions up to 6.8.0. An attacker can trick an administrator into performing unintended actions without their knowledge.
Risk Assessment
The risk involves the possibility of performing unauthorized operations in the WooCommerce admin panel, such as modifying settings or deleting data, without required authentication.
Recommendation
It is recommended to immediately update the Abandoned Cart Lite for WooCommerce plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Abandoned Cart Lite for WooCommerce <= 6.8.0
See all- CVE-2026-65557Medium
The Abandoned Cart Lite for WooCommerce plugin version 6.8.0 and earlier contains a Cross-Site Scripting (XSS) vulnerability for users with the Shop Manager role. A Shop Manager can inject malicious scripts.
- CVE-2026-12585High
The Abandoned Cart Lite for WooCommerce WordPress plugin before version 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account. This allows unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.
Original NVD description (English source)
Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.