Unauthorized Email Handling Vulnerability in Cart Abandonment Recovery Plugin for WooCommerce
CVE-2026-96900
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 14 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-96900?
The Cart Abandonment Recovery for WooCommerce plugin prior to version 2.1.4 is vulnerable as it fails to validate the ownership of email addresses used to access abandoned cart records. This allows unauthenticated attackers, armed with a customer's email, to manipulate or delete stored abandoned cart data without authorization, potentially compromising sensitive customer information and undermining the integrity of the e-commerce experience.
Affected Version(s)
Cart Abandonment Recovery for WooCommerce 0 < 2.1.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.