CVE-2026-97668 Overview
CVE-2026-97668 is a SQL Injection vulnerability [CWE-89] in the Abandoned Cart Pro for WooCommerce plugin for WordPress. All versions up to and including 10.8.0 are affected. The flaw resides in the update_guest_persistent_cart() function, where attacker-controlled checkout data flows into an UPDATE statement on the wp_usermeta table without proper preparation. Unauthenticated attackers can append arbitrary SQL to the query over the network. Successful exploitation allows extraction of sensitive database contents via time-based blind techniques and modification of wp_usermeta rows. Researchers have demonstrated escalating an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.
Critical Impact
Unauthenticated attackers can inject SQL into the wp_usermeta table, exfiltrate database contents, and escalate arbitrary accounts to WordPress administrator.
Affected Products
- Abandoned Cart Pro for WooCommerce plugin for WordPress
- All versions up to and including 10.8.0
- WordPress sites running WooCommerce with the vulnerable plugin enabled
Discovery Timeline
- 2026-10-14 - CVE-2026-97668 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-97668
Vulnerability Analysis
The vulnerability lives in the update_guest_persistent_cart() function of the Abandoned Cart Pro for WooCommerce plugin. The function handles guest cart persistence by writing an abandoned_cart_info value into the wp_usermeta table. While the adjacent SELECT and INSERT statements in the same code path use prepared statements, the UPDATE ... SET branch concatenates attacker-controlled input directly into the query string. The input passes only through stripslashes(), which performs no SQL escaping. Attackers submit payloads through checkout fields such as the SMS consent field, which populate the abandoned_cart_info meta value.
Root Cause
The root cause is insufficient escaping and missing query preparation on user-supplied data reaching an SQL sink. The developer applied wpdb::prepare() inconsistently across the three queries operating on the same meta value. The UPDATE statement relies on stripslashes() instead of parameterized queries, breaking the input validation contract and enabling second-order SQL injection into meta_value.
Attack Vector
The attack vector is remote and unauthenticated. An attacker initiates a guest checkout on a vulnerable WooCommerce storefront and submits a crafted payload in a persisted checkout field, such as the SMS consent field. When the plugin executes update_guest_persistent_cart(), the appended SQL is concatenated into the UPDATE wp_usermeta statement and executed. Attackers can perform time-based blind extraction to read password hashes, secret keys, and session data. They can also overwrite wp_capabilities rows to grant any target user the administrator role, enabling full site takeover.
No verified exploit code is published at this time. See the Wordfence Vulnerability Report for additional technical analysis.
Detection Methods for CVE-2026-97668
Indicators of Compromise
- Unexpected rows in wp_usermeta where meta_key equals wp_capabilities and meta_value contains administrator for accounts that should not hold that role.
- Checkout submissions containing SQL syntax tokens such as SLEEP(, BENCHMARK(, UNION SELECT, or stacked statement separators in the SMS consent or related guest cart fields.
- Abnormally long request processing times on checkout endpoints handled by the Abandoned Cart Pro plugin, consistent with time-based blind SQL injection.
- New or modified WordPress administrator accounts without a corresponding entry in wp_users creation logs.
Detection Strategies
- Review web server and WordPress logs for POST requests to WooCommerce checkout and cart endpoints containing SQL metacharacters in guest cart parameters.
- Audit the wp_usermeta table for duplicate wp_capabilities rows per user_id, which indicate the shadow-role escalation technique.
- Deploy WAF rules that inspect checkout field values for SQL injection payloads targeting the abandoned_cart_info meta value path.
Monitoring Recommendations
- Alert on sudden privilege changes within WordPress, including users gaining the administrator capability outside of normal administrative workflows.
- Monitor database query latency on wp_usermetaUPDATE statements to catch time-based blind injection patterns.
- Correlate guest checkout traffic with subsequent authenticated admin logins from matching IP ranges or user agents.
How to Mitigate CVE-2026-97668
Immediate Actions Required
- Update the Abandoned Cart Pro for WooCommerce plugin to a version later than 10.8.0 as soon as a fixed release is available from Tyche Softwares.
- Disable the plugin on production WordPress sites until a patched version is installed if guest checkout cannot be restricted.
- Audit all WordPress administrator accounts and remove any unauthorized role assignments found in wp_usermeta.
- Rotate WordPress secret keys in wp-config.php, administrator passwords, and WooCommerce API keys if compromise is suspected.
Patch Information
Refer to the Tyche Software Changelog for the official fix release notes and the WooCommerce Abandoned Cart Pro Plugin product page to obtain updated builds. The vendor advisory indexed by Wordfence is available in the Wordfence Vulnerability Report.
Workarounds
- Deploy a WAF rule that blocks SQL metacharacters in WooCommerce checkout fields consumed by the Abandoned Cart Pro plugin, including the SMS consent field.
- Disable guest checkout in WooCommerce settings so that the vulnerable update_guest_persistent_cart() code path is not reached by unauthenticated users.
- Restrict database privileges for the WordPress MySQL user to limit the ability to modify wp_usermeta rows outside of expected contexts where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
