CveMateVulnerability intelligence

Tyche Softwares vulnerabilities

22 vulnerabilities

Known vulnerabilities in Tyche Softwares products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 12 products.

Products

12

Abandoned Cart Pro For Woocommerce7 vulnerabilities
Arconix Shortcodes3 vulnerabilities
Arconix FAQ2 vulnerabilities
Order Delivery Date For Woocommerce2 vulnerabilities
Print Invoice & Delivery Notes For Woocommerce2 vulnerabilities
Product Delivery Date For Woocommerce – Lite2 vulnerabilities
Abandoned Cart Lite For Woocommerce1 vulnerabilities
Booking & Appointment Plugin For Woocommerce1 vulnerabilities
Currency Per Product For Woocommerce1 vulnerabilities
Custom Order Numbers For Woocommerce1 vulnerabilities
Payment Gateway Based Fees And Discounts For Woocommerce1 vulnerabilities
Product Input Fields For Woocommerce1 vulnerabilities

CVE-2026-97668tyche softwaresabandoned cart pro for woocommerce+18d ago14-10-2026 02:27

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.CVE-2026-97657tyche softwaresabandoned cart pro for woocommerce+18d ago14-10-2026 02:27

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter — combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omission, and an insecure direct object reference on the decrypted `abandoned_id` with no ownership verification confirming the cart belongs to the email used for decryption. This makes it possible for unauthenticated attackers who possess a single legitimate cart-recovery link (obtained from their own reminder email) to recover the keystream, forge a ciphertext that decrypts to any victim's cart ID, and trigger a call to `wp_set_auth_cookie()` for the victim user — achieving full account takeover of any user who has ever abandoned a cart, including administrators. The auto-login feature defaults to enabled and is forced on during plugin upgrades, meaning all affected installations are exploitable without any additional configuration.CVE-2026-102251tyche softwaresabandoned cart pro for woocommerce+18d ago14-10-2026 02:27

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. AES-CTR is a malleable stream cipher, so an attacker who obtains one legitimate token by abandoning a cart with an email address they control can recover the keystream and forge a ciphertext carrying arbitrary SQL. The HMAC check added in 10.4.1 is enforced only when the wcap_nonce parameter is present, so omitting the parameter skips it entirely.CVE-2025-4387tyche softwaresabandoned cart pro for woocommerce+11y ago10-06-2025 03:41

The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may allow for either remote or local code execution depending on the server configuration.CVE-2022-46795tyche softwaresprint invoice & delivery notes for woocommerce+21y ago13-12-2024 14:22

Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.7.2.CVE-2022-45367tyche softwarescustom order numbers for woocommerce+23y ago25-05-2023 09:55

Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Custom Order Numbers for WooCommerce plugin <= 1.4.0 versions.CVE-2024-31920tyche softwarescurrency per product for woocommerce+12y ago15-04-2024 09:27

Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Currency per Product for WooCommerce.This issue affects Currency per Product for WooCommerce: from n/a through 1.6.0.CVE-2024-31431tyche softwaresproduct input fields for woocommerce+12y ago15-04-2024 09:31

Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Product Input Fields for WooCommerce.This issue affects Product Input Fields for WooCommerce: from n/a through 1.7.0.CVE-2024-4233tyche softwaresarconix faq+52y ago08-05-2024 13:19

Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, Tyche Softwares Arconix FAQ.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.8.1; Arconix Shortcodes: from n/a through 2.1.10; Arconix FAQ: from n/a through 1.9.3.CVE-2024-38769tyche softwaresarconix shortcodes+21y ago01-11-2024 14:17

Missing Authorization vulnerability in Tyche Softwares Arconix Shortcodes allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Arconix Shortcodes: from n/a through 2.1.11.CVE-2024-38783tyche softwaresarconix faq+21y ago01-11-2024 14:17

Missing Authorization vulnerability in Tyche Softwares Arconix FAQ allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Arconix FAQ: from n/a through 1.9.4.CVE-2024-38702tyche softwaresproduct delivery date for woocommerce – lite+11y ago01-11-2024 14:18

Missing Authorization vulnerability in Tyche Softwares Product Delivery Date for WooCommerce – Lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through 2.7.2.CVE-2024-10729tyche softwaresbooking & appointment plugin for woocommerce+11y ago26-11-2024 02:06

The Booking & Appointment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_google_calendar_data' function in versions up to, and including, 6.9.0. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily.CVE-2024-32434tyche softwaresorder delivery date for woocommerce+12y ago15-04-2024 08:10

Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce.This issue affects Order Delivery Date for WooCommerce: from n/a through 3.20.2.CVE-2024-33585tyche softwarespayment gateway based fees and discounts for woocommerce+12y ago29-04-2024 12:43

Missing Authorization vulnerability in Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce.This issue affects Payment Gateway Based Fees and Discounts for WooCommerce: from n/a through 2.12.1.CVE-2026-56010tyche softwaresabandoned cart pro for woocommerce+13mo ago26-06-2026 14:52

Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.CVE-2026-66682tyche softwaresabandoned cart pro for woocommerce+12mo ago20-08-2026 12:07

Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.CVE-2026-81543tyche softwaresabandoned cart pro for woocommerce+11mo ago05-09-2026 07:38

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.CVE-2023-52210tyche softwaresproduct delivery date for woocommerce – lite+110mo ago23-12-2025 12:02

Vulnerability in Tyche softwares Product Delivery Date for WooCommerce – Lite.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through 2.7.0.CVE-2023-41874tyche softwaresorder delivery date for woocommerce+23y ago25-09-2023 00:42

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce plugin <= 3.20.0 versions.