CVE-2023-2986: tychesoftwares abandoned_cart_lite_for_woocommerce
Vulnerability summary
CVE-2023-2986 is a critical (CVSS 9.8) vulnerability in tychesoftwares abandoned_cart_lite_for_woocommerce. EPSS estimates a 42.54% chance of exploitation in the next 30 days, higher than 98.7% of scored vulnerabilities.
Timeline
- 08-06-2023PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
42.54%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 42.54% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Tychesoftwares1 product
- abandoned_cart_lite_for_woocommerce≤ 5.15.1 | ≤ 5.14.2
Wordpress1 product
- woocommerce-abandoned-cart≤ 5.15.1 (fixed in 5.15.2)
2 vendors · 2 products