CVE-2026-81543: WooCommerce Abandoned Cart Pro Escalation

CVE-2026-81543 Overview

CVE-2026-81543 is a privilege escalation vulnerability in the Abandoned Cart Pro for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 10.7.1. Multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data lack capability checks and nonce verification. Authenticated attackers with subscriber-level access can modify Simple Mail Transfer Protocol (SMTP) connector settings, reroute administrator recovery emails through an attacker-controlled server, and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration [CWE-269].

Critical Impact
Subscriber-level attackers can escalate to full WordPress administrator access by hijacking SMTP routing and intercepting auto-login recovery links.

Affected Products

Abandoned Cart Pro for WooCommerce plugin for WordPress (all versions ≤ 10.7.1)
WordPress sites with the plugin's auto-login feature enabled (default configuration)
WooCommerce deployments using the affected plugin for cart recovery workflows

Discovery Timeline

2026-09-05 - CVE-2026-81543 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-81543

Vulnerability Analysis

The vulnerability arises from broken access control on several plugin AJAX endpoints. The handlers for wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data do not verify user capabilities or nonce tokens before processing input. Because these actions are registered through the standard wp_ajax_ hook, any authenticated user (including subscribers) can invoke them.

The most impactful action is wcap_save_connector_settings, which controls the SMTP connector used by the plugin to send transactional email. An attacker overwrites the SMTP host, username, password, and port with credentials for a mail server they control. Subsequent password reset requests, recovery emails, and auto-generated cart recovery links are delivered through the attacker's SMTP infrastructure.

The plugin's auto-login feature embeds signed login tokens in cart recovery emails. Once outbound mail flows through the attacker's server, the attacker harvests these tokens and authenticates as the target account, including administrator accounts. This chains the SMTP redirection primitive into full site takeover.

Root Cause

The root cause is missing authorization on AJAX handlers combined with the absence of check_ajax_referer or equivalent nonce validation. WordPress plugin guidance requires capability checks such as current_user_can( 'manage_options' ) on privileged actions, which these handlers omit.

Attack Vector

Exploitation requires network access to the WordPress site and any authenticated session, including a self-registered subscriber account on sites that allow open registration. The attacker submits a crafted POST request to admin-ajax.php targeting the vulnerable action names to overwrite SMTP settings, then triggers a password reset for an administrator account to receive the intercepted recovery link.

Refer to the Wordfence Vulnerability Analysis for technical details on the vulnerable AJAX handlers.

Detection Methods for CVE-2026-81543

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php with action=wcap_save_connector_settings originating from low-privilege user sessions.
SMTP configuration changes in the Abandoned Cart Pro plugin settings that reference unfamiliar mail relay hostnames or credentials.
Password reset or auto-login emails for administrator accounts that were not requested by the account owner.
New or unexpected administrator logins shortly after cart recovery or password reset email events.

Detection Strategies

Review WordPress access logs for authenticated non-admin users invoking the affected wcap_* AJAX actions.
Alert on modifications to plugin option keys that store SMTP connector settings, particularly changes to host, port, or credential fields.
Correlate outbound SMTP configuration changes with subsequent administrator password reset requests within short time windows.

Monitoring Recommendations

Enable WordPress audit logging for plugin option changes and user role modifications.
Monitor outbound SMTP traffic for unexpected destinations following plugin configuration updates.
Track subscriber-role account creation rates and correlate with AJAX activity to identify reconnaissance.

How to Mitigate CVE-2026-81543

Immediate Actions Required

Update the Abandoned Cart Pro for WooCommerce plugin to a version released after 10.7.1 that addresses the missing capability and nonce checks.
Audit current SMTP connector settings in the plugin and reset them to trusted values if any unauthorized modification is detected.
Force password resets for all administrator accounts and invalidate outstanding auto-login tokens.
Disable open user registration or restrict the default new-user role if subscriber-level enrollment is not required.

Patch Information

Consult the WooCommerce Abandoned Cart Pro product page and the Wordfence Vulnerability Analysis for the fixed release and vendor advisory details. Apply the vendor-supplied update through the WordPress plugin manager or by replacing the plugin files with the patched version.

Workarounds

Disable the plugin's auto-login feature until the patch is applied to break the token interception chain.
Restrict access to /wp-admin/admin-ajax.php for unauthenticated and low-privilege users at the Web Application Firewall (WAF) layer, specifically blocking the four vulnerable wcap_* action names.
Temporarily deactivate the Abandoned Cart Pro plugin on sites that cannot immediately update.

bash

# Example WAF rule to block vulnerable AJAX actions until patched
# ModSecurity-style pattern
SecRule ARGS:action "@rx ^wcap_(save_connector_settings|send_manual_email|abandoned_cart_info|change_manual_email_data)$" \
  "id:1026815430,phase:2,deny,status:403,log,msg:'Block CVE-2026-81543 vulnerable wcap AJAX action'"