Unauthenticated Access Vulnerability in Abandoned Cart Lite for WooCommerce Plugin
CVE-2026-12585
Currently unrated
What is CVE-2026-12585?
The Abandoned Cart Lite for WooCommerce plugin prior to version 6.8.2 presents a significant security concern by failing to safeguard the integrity of its cart-recovery tokens. This vulnerability enables unauthenticated attackers to generate fraudulent recovery links, potentially allowing them to log in as other users if the automatic login feature is activated. This poses serious risks for user account security and could lead to unauthorized access to sensitive information.
Affected Version(s)
Abandoned Cart Lite for WooCommerce 0 < 6.8.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.