CVE-2026-102251: WooCommerce Abandoned Cart Pro SQLi Vulnerability

CVE-2026-102251 Overview

CVE-2026-102251 is a SQL injection vulnerability in the Abandoned Cart Pro for WooCommerce plugin for WordPress [CWE-89]. The flaw affects all versions up to and including 10.8.0 and is reachable via the validate parameter. Unauthenticated attackers can append arbitrary SQL to existing queries and extract sensitive data from the WordPress database. The weakness is compounded by the plugin's use of AES-CTR, a malleable stream cipher, which allows an attacker who obtains one legitimate token to forge ciphertext carrying attacker-controlled SQL. An HMAC check added in version 10.4.1 runs only when the wcap_nonce parameter is supplied, so omitting the parameter bypasses integrity validation entirely.

Critical Impact
Unauthenticated remote attackers can exfiltrate arbitrary data from the WordPress database, including user credentials, session tokens, and customer order information.

Affected Products

Abandoned Cart Pro for WooCommerce (Tyche Softwares) — all versions through 10.8.0
WordPress sites running WooCommerce with the affected plugin installed
Deployments relying on the 10.4.1 HMAC check without enforcing the wcap_nonce parameter

Discovery Timeline

2026-10-14 - CVE-2026-102251 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-102251

Vulnerability Analysis

The vulnerability resides in the handling of the validate parameter used by the abandoned cart recovery workflow. The plugin accepts a token that identifies a cart, decrypts it, and uses the resulting value inside a SQL query without sufficient escaping or prepared-statement binding. Because the decrypted content flows directly into query construction, an attacker who controls the ciphertext controls the SQL that executes against the database.

The cryptographic layer intended to protect the token offers no integrity guarantee on its own. AES-CTR is a stream cipher where ciphertext is XORed with a keystream. An attacker who abandons a cart under an email address they control receives a valid token, and because the plaintext is predictable, the keystream can be recovered. From there, the attacker can craft new ciphertext that decrypts to any payload, including UNION-based SQL injection fragments.

Root Cause

Two defects combine to create the issue. First, the SQL query concatenates user-influenced input without parameterized bindings [CWE-89]. Second, the HMAC authentication added in version 10.4.1 is gated behind the presence of the wcap_nonce parameter. Requests that simply omit wcap_nonce skip the integrity check and reach the vulnerable query path with forged ciphertext.

Attack Vector

The attack is remote, requires no authentication, and no user interaction. An attacker initiates an abandoned cart with an email they control to obtain a legitimate validate token. They recover the AES-CTR keystream from the known plaintext, then craft a new token containing SQL payloads. Finally, they send a request to the validation endpoint with the forged token and without the wcap_nonce parameter, causing the injected SQL to execute and return database contents.

No verified exploit code is published. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-102251

Indicators of Compromise

Requests to WooCommerce abandoned cart endpoints containing a validate parameter but no wcap_nonce parameter.
Unusual response sizes or timing from the abandoned cart recovery URL, consistent with UNION-based or time-based SQL injection.
Database query logs showing UNION SELECT, information_schema, or wp_users references originating from the plugin's query functions.
Outbound traffic from the WordPress host to attacker infrastructure following abandoned cart recovery requests.

Detection Strategies

Inspect web server access logs for repeated hits to the abandoned cart validation endpoint from the same source IP within a short interval.
Enable MySQL general query logging in staging and search for unexpected SQL syntax originating in plugin-prefixed queries.
Deploy a web application firewall rule that flags validate parameters whose base64-decoded contents contain SQL keywords.

Monitoring Recommendations

Alert on HTTP requests to the abandoned cart endpoint missing the wcap_nonce parameter but presenting a validate token.
Monitor WordPress wp_users and wp_usermeta tables for abnormal read patterns from the web application user.
Correlate failed WordPress login attempts with prior database reads to identify credential exfiltration followed by reuse.

How to Mitigate CVE-2026-102251

Immediate Actions Required

Update Abandoned Cart Pro for WooCommerce to the fixed release listed in the Tyche Software Changelog.
Rotate any secrets, API keys, or administrator credentials that may have been accessible to the WordPress database user.
Audit the wp_users, wp_usermeta, and WooCommerce order tables for unauthorized reads during the exposure window.
Review recent abandoned cart recovery traffic for requests missing the wcap_nonce parameter.

Patch Information

Tyche Softwares has issued updates addressing the SQL injection and the HMAC bypass. Administrators should install the latest version from the vendor portal and verify the plugin version in the WordPress admin dashboard. See the vendor product page for release details.

Workarounds

Disable the Abandoned Cart Pro for WooCommerce plugin until the patched version is deployed.
Block requests to the abandoned cart validation endpoint that lack the wcap_nonce parameter at the WAF or reverse proxy.
Restrict the WordPress database user's privileges so it cannot read tables outside the WooCommerce schema where feasible.

bash

# Example WAF rule (ModSecurity) to block requests missing wcap_nonce
SecRule REQUEST_URI "@contains wcap" \
    "chain,phase:2,deny,status:403,id:1026102251,\
    msg:'CVE-2026-102251 Abandoned Cart Pro SQLi attempt'"
    SecRule ARGS:validate "!@rx ^$" \
        "chain"
        SecRule &ARGS:wcap_nonce "@eq 0"