CVE-2026-97657: Abandoned Cart Pro WooCommerce Auth Bypass

CVE-2026-97657 Overview

CVE-2026-97657 is an authentication bypass vulnerability in the Abandoned Cart Pro for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 10.8.0. It stems from malleable AES-CTR encryption combined with a bypassable HMAC check and an insecure direct object reference [CWE-639] on cart identifiers. Unauthenticated attackers who possess a single legitimate cart-recovery link can forge tokens that trigger wp_set_auth_cookie() for any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forcibly re-enabled during plugin upgrades, meaning every affected installation is exploitable without additional configuration.

Critical Impact
Full account takeover of any WordPress user who has abandoned a cart, including site administrators, from a single unauthenticated HTTP request.

Affected Products

Abandoned Cart Pro for WooCommerce (WordPress plugin) — all versions up to and including 10.8.0
WordPress sites with the plugin's auto-login cart-recovery feature enabled (default)
WooCommerce installations where administrators or privileged users have ever abandoned a cart

Discovery Timeline

2026-10-14 - CVE-2026-97657 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-97657

Vulnerability Analysis

The plugin generates cart-recovery links containing an encrypted abandoned_id token and a user_email parameter. The encryption uses AES in Counter (CTR) mode without a Message Authentication Code (MAC), making ciphertexts malleable. The 8-byte CTR nonce is embedded in the ciphertext blob itself, and the decryption key is derived from the attacker-supplied user_email GET parameter. The wcap_email_track_links() function performs an HMAC-based nonce verification using the wcap_nonce parameter, but the check only runs when wcap_nonce is non-empty. Omitting the parameter entirely bypasses verification. Finally, no ownership check confirms that the decrypted abandoned_id belongs to the email used for decryption. The combination permits token forgery and arbitrary auto-login.

Root Cause

Three compounding defects produce the vulnerability. First, AES-CTR without authentication allows an attacker holding one valid plaintext/ciphertext pair to recover the keystream and forge any plaintext of equal length. Second, the HMAC nonce guard is skipped on empty input rather than failing closed. Third, the authentication flow trusts the decrypted cart ID without verifying it maps to the supplied email address, producing an insecure direct object reference.

Attack Vector

An attacker first abandons a cart on the target site to receive a legitimate recovery email containing a valid encrypted token. The attacker XORs the known plaintext (their own abandoned_id) against the ciphertext to recover the AES-CTR keystream. The attacker then XORs the keystream against a target abandoned_id value to produce a forged ciphertext. Submitting the forged token to the cart-recovery endpoint without a wcap_nonce parameter, and with the victim's user_email, causes the plugin to call wp_set_auth_cookie() for the victim account. The attacker gains an authenticated session as that user.

See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-97657

Indicators of Compromise

Requests to the cart-recovery endpoint containing a user_email parameter but missing the wcap_nonce parameter
Multiple cart-recovery requests from a single source IP targeting different user_email values
Unexpected wp_set_auth_cookie() session creation for administrator or high-privilege accounts without a corresponding /wp-login.php POST
Administrator sessions originating from IP addresses not previously associated with the account

Detection Strategies

Inspect web server access logs for wcap_action or cart-recovery query strings and alert when wcap_nonce is absent
Correlate WordPress authentication cookie issuance events with the originating request path to identify logins that bypassed /wp-login.php
Monitor the wp_users and wp_abandoned_cart tables for recovery activity tied to administrative accounts

Monitoring Recommendations

Enable verbose authentication logging in WordPress and forward events to a centralized logging platform
Baseline normal cart-recovery request patterns and alert on volume spikes or distinct email enumeration
Track plugin version inventory across all WordPress sites and alert on installations at or below 10.8.0

How to Mitigate CVE-2026-97657

Immediate Actions Required

Disable the Abandoned Cart Pro for WooCommerce plugin until a patched release is installed and verified
Disable the auto-login cart-recovery feature in plugin settings even after patching, if business requirements permit
Force a password reset and invalidate active sessions for all administrator and privileged accounts
Audit the wp_abandoned_cart table and WordPress user list for unexpected recently-authenticated accounts

Patch Information

At the time of publication, no fixed version is identified in the NVD record. Monitor the Tyche Software Changelog for a release that remediates the issue, and consult the Tyche Abandoned Cart Plugin product page for upgrade instructions. Note that the vendor's upgrade routine has historically re-enabled auto-login, so verify configuration after any update.

Workarounds

Block requests to the cart-recovery endpoint at a Web Application Firewall (WAF) when the wcap_nonce parameter is empty or missing
Restrict access to WordPress administrative accounts using IP allowlisting or multi-factor authentication plugins that validate at session creation
Remove or deactivate the plugin and migrate abandoned cart recovery to an alternative solution until a verified patch is available

bash

# Example WAF rule (ModSecurity) to block requests missing wcap_nonce
SecRule ARGS:wcap_action "@streq track_links" \
  "id:1026097657,phase:2,deny,status:403,\
  chain,msg:'CVE-2026-97657 cart-recovery nonce bypass attempt'"
  SecRule &ARGS:wcap_nonce "@eq 0"