Authentication Bypass in Abandoned Cart Pro for WooCommerce by Tyche Softwares

CVE-2026-97657

What is CVE-2026-97657?

The Abandoned Cart Pro for WooCommerce plugin is susceptible to an authentication bypass due to insecure encryption practices implemented in all versions up to 10.8.0. This vulnerability arises from the use of MAC-free AES-CTR encryption for cart-recovery link tokens. The mechanism fails to enforce necessary nonce checks under certain conditions, letting unauthorized attackers exploit legitimate cart-recovery links to recover keystreams. This results in the potential for forging a ciphertext that can decrypt to any user's cart ID. By tricking the system into invoking wp_set_auth_cookie(), attackers can achieve complete account takeover of victims, including admin accounts, unchecked by cart ownership validations. The default enabled auto-login feature during plugin updates further exacerbates the exploitable risk across affected installations.

References