CVE-2026-12585: Abandoned Cart Lite Auth Bypass Flaw

CVE-2026-12585 Overview

CVE-2026-12585 affects the Abandoned Cart Lite for WooCommerce WordPress plugin in versions prior to 6.8.2. The plugin fails to protect the integrity of its cart-recovery tokens and does not bind these tokens to the requesting user account. Unauthenticated attackers can forge a recovery link that authenticates them as any target user when the automatic-login option is enabled. This is an authentication bypass vulnerability that leads to account takeover on affected WooCommerce stores.

Critical Impact
Unauthenticated attackers can log in as any store customer or administrator by forging cart-recovery tokens, resulting in full account takeover.

Affected Products

Abandoned Cart Lite for WooCommerce WordPress plugin versions before 6.8.2
WordPress sites running WooCommerce with the affected plugin
Deployments with the automatic-login option enabled

Discovery Timeline

2026-07-16 - CVE-2026-12585 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-12585

Vulnerability Analysis

The Abandoned Cart Lite for WooCommerce plugin generates recovery tokens that customers use to return to their abandoned shopping carts. When the automatic-login option is enabled, following a recovery link authenticates the visitor into the associated user account. The plugin does not sign or otherwise protect the integrity of these tokens. It also does not verify that the token presented in a request corresponds to the user session initiating the recovery flow.

An attacker can craft or predict a recovery link that references an arbitrary account. Submitting that link triggers automatic authentication as the referenced user. Because the flaw requires no prior authentication, any anonymous visitor with knowledge of the target account identifier can exploit it. Successful exploitation compromises customer accounts and, where a shop administrator has an abandoned cart entry, administrative access to the WordPress site.

Root Cause

The vulnerability stems from two related weaknesses in the recovery token workflow. First, tokens lack cryptographic integrity protection, allowing them to be forged or guessed. Second, the recovery handler does not bind a token to the account that generated it, so any presented token is accepted for any user reference. Together these issues constitute an authentication bypass through improper validation of authentication tokens.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker constructs a request to the plugin's cart-recovery endpoint using a forged token that references the victim account. The server accepts the token, invokes the automatic-login routine, and returns a session bound to the victim. The attacker then performs any action the victim account is authorized to perform.

No verified proof-of-concept code is publicly available. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-12585

Indicators of Compromise

Requests to cart-recovery endpoints containing tokens for accounts unrelated to the visitor's session or IP history.
WordPress login events immediately following an anonymous GET to a plugin recovery URL with no prior authentication flow.
New session cookies issued to IPs that never completed a checkout or account registration.
Administrative actions from accounts that have no prior login pattern from the source IP or user agent.

Detection Strategies

Review web server logs for high volumes of requests to cart-recovery URLs with varying token or user parameters, indicating enumeration.
Correlate WordPress authentication events with the immediately preceding HTTP request path to identify logins triggered by recovery links.
Alert on privileged account logins where the request chain originated from a plugin recovery endpoint.

Monitoring Recommendations

Enable WordPress authentication logging and forward events to a central log store for correlation.
Monitor the plugin's recovery endpoint for anomalous request rates and diverse target account references from single sources.
Track administrator session creation events and flag any that follow an unauthenticated recovery request.

How to Mitigate CVE-2026-12585

Immediate Actions Required

Update the Abandoned Cart Lite for WooCommerce plugin to version 6.8.2 or later on all WordPress instances.
Disable the automatic-login option in the plugin configuration until the update is applied.
Audit recent WordPress login events for logins originating from cart-recovery URLs against unexpected accounts.
Force password resets for administrator and staff accounts if suspicious authentication events are found.

Patch Information

The vendor fixed this issue in Abandoned Cart Lite for WooCommerce version 6.8.2. Site operators should update through the WordPress plugin manager or by replacing the plugin files with the patched release. See the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the automatic-login setting in the plugin, requiring users to authenticate normally after following a recovery link.
Deactivate the plugin entirely on sites where it is not required for active abandoned-cart campaigns.
Restrict access to the plugin's recovery endpoint using a web application firewall rule until patching is complete.

bash

# Update the plugin using WP-CLI
wp plugin update woocommerce-abandoned-cart --version=6.8.2

# Verify the installed version
wp plugin get woocommerce-abandoned-cart --field=version