Privilege Escalation Vulnerability in Abandoned Cart Pro for WooCommerce Plugin by WordPress

CVE-2026-81543

What is CVE-2026-81543?

The Abandoned Cart Pro for WooCommerce plugin for WordPress contains a vulnerability that allows authenticated users with subscriber-level access and above to escalate their privileges. This vulnerability arises from inadequate capability checks and nonce verification on several AJAX actions, enabling attackers to manipulate SMTP connector settings. Consequently, they can reroute administrator recovery emails through a server controlled by the attacker. Additionally, this exploitation can lead to the interception of auto-login links, resulting in potential full administrative access when the plugin’s auto-login feature is enabled.

References