Authentication Bypass in Abandoned Cart Lite for WooCommerce Plugin by Tyche Softwares

CVE-2023-2986

Summary

The Abandoned Cart Lite for WooCommerce plugin for WordPress has a significant vulnerability that allows attackers to bypass authentication due to inadequate encryption used during the decoding of links for abandoned carts. This flaw primarily affects versions up to and including 5.14.2, permitting unauthenticated users to log in as actual customers who have abandoned their carts. The security of the plugin was enhanced in subsequent versions, specifically 5.15.1, which addressed vulnerabilities associated with historical checkout links. Further improvements were made in version 5.15.2 to ensure that null key values could not exploit the authentication bypass.

References