CVE-2026-81543
HighCVSS 8.8Summary
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.
Risk Assessment
The risk includes full administrator account takeover, potentially leading to complete compromise of the WordPress site.
Recommendation
It is recommended to immediately update the plugin to a patched version and restrict access to AJAX actions with proper capability checks and nonce verification.
Other vulnerabilities in Abandoned Cart Pro for WooCommerce
See all- CVE-2026-66682Critical
Unauthenticated privilege escalation vulnerability in the Abandoned Cart Pro for WooCommerce plugin. Affects versions up to 10.4.0.
- CVE-2026-56010High
The vulnerability in the Abandoned Cart Pro plugin for WooCommerce version 10.4.0 and below allows subscribers to escalate privileges. An attacker can exploit this flaw to gain unauthorized access to administrative functions.
Original NVD description (English source)
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.