SQL Injection Vulnerability in Abandoned Cart Pro for WooCommerce by Tyche Softwares

CVE-2026-102251

What is CVE-2026-102251?

The Abandoned Cart Pro for WooCommerce plugin is susceptible to SQL Injection through the 'validate' parameter. This vulnerability stems from inadequate escaping of user-supplied input and insufficient preparation of SQL queries. Unauthenticated attackers can exploit this flaw to insert arbitrary SQL queries into existing ones, enabling potential extraction of sensitive data from the database. The weakness arises particularly from the malleability of the AES-CTR cipher. Attackers may leverage legitimate tokens acquired from abandoned carts to forge SQL queries. Notably, the HMAC check introduced in version 10.4.1 may be bypassed if the wcap_nonce parameter is omitted, amplifying the risk.

References