CVE-2026-81543: tyche softwares abandoned cart pro for woocommerce Improper Privilege Management

Vulnerability summary

CVE-2026-81543 is a high (CVSS 8.8) Improper Privilege Management vulnerability in tyche softwares abandoned cart pro for woocommerce. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.3% of scored vulnerabilities. Fixed in 10.7.2.

Timeline

1. 05-09-2026
   PublishedVulnerability first disclosed.
2. 07-09-2026
   Last modifiedVulnerability information updated.

Description

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.