Read the docs
TI-2026-73799 Aliases CVE-2026-97668GHSA-xc7m-7p9h-4hfm

Unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce

Priority MEDIUM 49CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Abandoned Cart Pro for WooCommerce by Tyche Softwares is affected from 0 through 10.8.0. Guest cart data is concatenated into an UPDATE query without preparation, causing SQL injection (CWE-89). An unauthenticated attacker can inject SQL via checkout fields to extract database data with time-based blind techniques and modify usermeta rows. The flaw has been demonstrated to escalate an arbitrary account to administrator.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00445 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tychesoftwaresAbandoned Cart Pro for WooCommerceup to 10.8.0—No fix listedCNA
  • Abandoned Cart Pro for WooCommerce Vendortychesoftwares Affected up to 10.8.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Abandoned Cart Pro for WooCommerce.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-97668
  2. 2026-10-14 Alias added: GHSA-xc7m-7p9h-4hfm
  3. 2026-10-16 CISA SSVC decision points changed

References

Other 3

  • TI-2025-02538 Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update CVSS 3.1CRITICAL 9.8
  • TI-2023-02798 Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2025-02560 Order Delivery Date Pro for WooCommerce < 12.4.0 - Reflected XSS CVSS 3.1HIGH 7.1
  • TI-2023-00453 Print Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS CVSS 3.1MEDIUM 6.1
  • TI-2025-12589 Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2025-02570 Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure CVSS 3.1MEDIUM 4.3
See all 64 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences