Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-288.
Summary
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tychesoftwares | Abandoned Cart Lite for WooCommerce | up to 5.15.1 | — | No fix listed | CNA |
- Abandoned Cart Lite for WooCommerce Vendortychesoftwares Affected up to 5.15.1 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:* | up to 5.14.2 | Vulnerable | tychesoftwares |
- cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions up to 5.14.2 Vulnerable ·tychesoftwares
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-2986
- 2026-10-03 Alias added: GHSA-54x7-q6m6-mjqv
References
Patch 3
Other 4
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925274%40woocommerce-abandoned-cart&new=2925274%40woocommerce-abandoned-cart&sfp_email=&sfph_mail=
- https://www.wordfence.com/blog/2023/06/tyche-softwares-addresses-authentication-bypass-vulnerability-in-abandoned-cart-lite-for-woocommerce-wordpress-plugin/
- https://github.com/TycheSoftwares/woocommerce-abandoned-cart/pull/885#issuecomment-1601813615
- https://github.com/Ayantaker/CVE-2023-2986
More tychesoftwares Abandoned Cart Lite For Woocommerce vulnerabilities
- TI-2019-15255 Cross-site scripting in tychesoftwares Abandoned Cart Lite for WooCommerce CVSS 3.1HIGH 7.2
- TI-2023-24048 WordPress Abandoned Cart Lite for WooCommerce Plugin <= 5.15.2 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.9
- TI-2021-03271 Abandoned Cart Lite for WooCommerce <= 5.8.5 - Cross-Site Request Forgery Bypass CVSS 3.1MEDIUM 4.3
Sources
- CVE-2023-2986 · CVE Program
- CVE-2023-2986 · NVD
- FIRST EPSS
- GHSA-54x7-q6m6-mjqv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences