10.8.0: Abandoned Cart Pro Auto-Login Flaw Enables Credential-Free Admin Account Hijack

A critical authentication bypass vulnerability in the Abandoned Cart Pro plugin for WordPress allows unauthenticated attackers to take over any user account on affected sites. This flaw enables complete control of the website, including administrative privileges, by manipulating encryption tokens used for cart recovery.

The issue stems from malleable encryption and a bypassable HMAC check in versions up to 10.8.0. Attackers can recover the keystream using a single legitimate cart-recovery link, then forge a ciphertext that decrypts to any victim's cart ID. This triggers an authentication cookie for the target user.

Technical Mechanism

The vulnerability, tracked as CVE-2026-97657, carries a CVSS score of 9.8. It involves MAC-free AES-CTR encryption where the eight-byte CTR nonce is included in the ciphertext blob. The encryption key is looked up using an attacker-supplied email parameter. An HMAC nonce check is only enforced if a specific parameter is non-empty, allowing complete bypass by omission.

Scope of Exposure

All installations of Abandoned Cart Pro for WooCommerce running version 10.8.0 or earlier are affected. The plugin’s auto-login feature defaults to enabled and is forced on during upgrades. This means no additional configuration is required for exploitation. Any user who has abandoned a cart, including site administrators, is at risk of full account takeover.

Defender's checklist

Security teams should immediately inventory all WordPress installations for the Abandoned Cart Pro plugin. Verify the installed version against the affected range up to 10.8.0. Check server logs for unusual authentication events or unexpected admin logins. Monitor for any unauthorized changes to site content or user permissions.

Operational impact

Organizations should assess their exposure by reviewing which plugins handle authentication or session management. Teams usually need to verify if default security settings have been altered or if legacy plugins remain active. Communicate with internal IT and legal teams to understand data breach notification requirements if accounts were compromised. Ensure supplier contracts include clauses for timely security updates and vulnerability disclosure.

What to do and how to stay safe: Abandoned Cart Pro

• Audit your WordPress plugins to identify if Abandoned Cart Pro is installed and check its version.
• Monitor authentication logs for suspicious activity, such as logins from unfamiliar locations or times.
• Review user accounts for unauthorized privilege escalations or new admin users.
• Once the vendor provides an update, apply it immediately to mitigate the authentication bypass risk.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Abandoned Cart Pro are vulnerable to this flaw?

All versions up to and including 10.8.0 are affected by the authentication bypass vulnerability.

Can an attacker take over an administrator account with this flaw?

Yes, the flaw allows full account takeover of any user who has abandoned a cart, including administrators.

Is this vulnerability actively being exploited?

The source material confirms the technical capability for exploitation but does not report on active wild exploitation.