{"schemaVersion":1,"id":"CVE-2026-97668","requestedId":"CVE-2026-97668","aliases":[],"status":"published","rawState":"Deferred","rawSeverityStatus":"Deferred","duplicateOf":null,"indexable":true,"title":null,"description":"The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.","dates":{"published":"2026-10-14T02:27:37.892Z","modified":"2026-10-14T02:27:37.892Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"cve.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"cve.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"nvd","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00445,"percentile":0.37073,"severity":"low","asOf":"2026-10-14T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-14T00:00:00.000Z","score":0.00445,"percentile":0.37073}],"last30":[{"date":"2026-10-14T00:00:00.000Z","score":0.00445,"percentile":0.37073}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","evidence":[]},"exploits":[],"exploitCount":0,"exploitSources":[],"weaknesses":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/89.html","capec":[{"id":"CAPEC-108","name":"Command Line Execution through SQL Injection","url":"https://capec.mitre.org/data/definitions/108.html"},{"id":"CAPEC-109","name":"Object Relational Mapping Injection","url":"https://capec.mitre.org/data/definitions/109.html"},{"id":"CAPEC-110","name":"SQL Injection through SOAP Parameter Tampering","url":"https://capec.mitre.org/data/definitions/110.html"},{"id":"CAPEC-470","name":"Expanding Control over the Operating System from the Database","url":"https://capec.mitre.org/data/definitions/470.html"},{"id":"CAPEC-66","name":"SQL Injection","url":"https://capec.mitre.org/data/definitions/66.html"},{"id":"CAPEC-7","name":"Blind SQL Injection","url":"https://capec.mitre.org/data/definitions/7.html"}],"techniques":[],"countermeasures":[]}],"ttp":{"capecs":[{"id":"CAPEC-108","name":"Command Line Execution through SQL Injection","url":"https://capec.mitre.org/data/definitions/108.html","weaknessIds":["CWE-89"],"techniqueIds":[]},{"id":"CAPEC-109","name":"Object Relational Mapping Injection","url":"https://capec.mitre.org/data/definitions/109.html","weaknessIds":["CWE-89"],"techniqueIds":[]},{"id":"CAPEC-110","name":"SQL Injection through SOAP Parameter Tampering","url":"https://capec.mitre.org/data/definitions/110.html","weaknessIds":["CWE-89"],"techniqueIds":[]},{"id":"CAPEC-470","name":"Expanding Control over the Operating System from the Database","url":"https://capec.mitre.org/data/definitions/470.html","weaknessIds":["CWE-89"],"techniqueIds":[]},{"id":"CAPEC-66","name":"SQL Injection","url":"https://capec.mitre.org/data/definitions/66.html","weaknessIds":["CWE-89"],"techniqueIds":[]},{"id":"CAPEC-7","name":"Blind SQL Injection","url":"https://capec.mitre.org/data/definitions/7.html","weaknessIds":["CWE-89"],"techniqueIds":[]}],"techniques":[],"countermeasures":[],"countermeasuresByTactic":[]},"affected":[{"vendor":"tyche softwares","product":"abandoned cart pro for woocommerce","name":"Abandoned Cart Pro for WooCommerce","label":"abandoned cart pro for woocommerce","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"source":null,"versions":[{"text":"≤ 10.8.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 10.8.0","eol":null},{"vendor":"wordpress","product":"woocommerce-abandon-cart-pro","name":"Abandoned Cart Pro for WooCommerce","label":"woocommerce-abandon-cart-pro","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"source":null,"versions":[{"text":"≤ 10.8.0 (fixed in 10.8.1)","noFixRecorded":false,"fixedIn":"10.8.1"}],"versionsText":"≤ 10.8.0 (fixed in 10.8.1)","eol":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d91ffee-6902-4553-af3b-8ef4e5199367?source=cve","label":"www.wordfence.com/threat-intel/vulnerabilities/id/9d91ffee-6902-4553-af3b-8ef4e5199367?source=cve","hostname":"www.wordfence.com","tags":[],"sources":["cve.org","nvd"]},{"url":"https://www.tychesoftwares.com/products/woocommerce-abandoned-cart-pro-plugin/","label":"www.tychesoftwares.com/products/woocommerce-abandoned-cart-pro-plugin/","hostname":"www.tychesoftwares.com","tags":[],"sources":["cve.org","nvd"]},{"url":"https://www.tychesoftwares.com/docs/docs/abandoned-cart-pro-for-woocommerce-new/changelog-abandoned-cart-pro/","label":"www.tychesoftwares.com/docs/…","hostname":"www.tychesoftwares.com","tags":[],"sources":["cve.org","nvd"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d91ffee-6902-4553-af3b-8ef4e5199367","label":"www.wordfence.com/threat-intel/vulnerabilities/id/9d91ffee-6902-4553-af3b-8ef4e5199367","hostname":"www.wordfence.com","tags":["Vendor Advisory"],"sources":["wordfence"]}],"droppedReferenceCount":0,"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-14T02:27:37.892Z","label":"Published","detail":"Vulnerability first disclosed.","source":null}],"risk":{"score":70,"level":"high","profile":"default","profileName":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10},"appliedRules":["high-cvss-alone"]},"warnings":[],"meta":{"dataAsOf":"2026-10-14T23:32:26.524Z","stale":false,"partial":false}}