blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-81543

HIGH 8.8 CVSS 3.1
Published
September 5, 2026
Last modified
September 8, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-269
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.

Affected products and versions

  • Tyche Softwares Abandoned Cart Pro for WooCommerce — Up to and including 10.7.1

References

  • woocommerce.com https://woocommerce.com/products/abandoned-cart-pro/
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d8aa73-2e68-4353-a603-6fb61ab3406b?source=cve
  • nvd.nist.gov Official NVD record