SQL Injection Vulnerability in Abandoned Cart Pro for WooCommerce by Tyche Softwares
CVE-2026-97668

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Abandoned Cart Pro For WooCommerce
Vendor
CVE Published:
14 October 2026

What is CVE-2026-97668?

The Abandoned Cart Pro for WooCommerce plugin suffers from a SQL Injection vulnerability due to inadequate data escaping in the update_guest_persistent_cart() function. This flaw allows unauthenticated attackers to manipulate SQL queries through attacker-controlled input fields, enabling them to extract sensitive data and potentially escalate accounts to administrator privileges by altering the wp_capabilities field in the wp_usermeta table. This vulnerability affects all versions up to and including 10.8.0, emphasizing the need for immediate attention to secure WordPress installations using this plugin.

Affected Version(s)

Abandoned Cart Pro for WooCommerce 0 <= 10.8.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.tychesoftwares.com/products/woocommerce-aband...
https://www.tychesoftwares.com/docs/docs/abandoned-cart-p...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Taoufik El Adel
.