Description

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-05T08:16:40.730Z",
  "pubdate": "2026-09-05T08:16:40.730Z",
  "executiveSummary": "The Abandoned Cart Pro for WooCommerce plugin for WordPress, in versions up to and including 10.7.1, contains multiple critical vulnerabilities leading to unauthorized privilege escalation. The security flaw stems from the absence of essential capability checks and nonce validation across several administrative AJAX actions. This oversight allows authenticated users, regardless of low-level roles such as subscribers, to perform sensitive operations intended only for site administrators.\nThe primary risk involves the unauthorized modification of SMTP connector settings. By redirecting outgoing server mail traffic through an attacker-controlled infrastructure, malicious actors can intercept administrative recovery emails and automated login credentials. Given that the plugin’s auto-login feature is enabled by default, the exploitation of these AJAX endpoints provides a reliable vector for full administrative account takeover. Because the vulnerability requires only low-level subscriber access, it presents a significant threat to any WordPress installation utilizing the plugin, potentially leading to complete site compromise, data exfiltration, and unauthorized control over the WooCommerce environment.",
  "technicalDetails": "The root cause of this vulnerability is improper access control and missing CSRF protection within the plugin's AJAX handler architecture. Specifically, the functions 'wcap_save_connector_settings', 'wcap_send_manual_email', 'wcap_abandoned_cart_info', and 'wcap_change_manual_email_data' fail to verify the caller's capability levels or validate nonces before executing requested operations. Consequently, the application processes requests from any authenticated WordPress user, violating the principle of least privilege.\nThe exploitation flow begins with an authenticated attacker possessing subscriber-level privileges initiating a crafted request to the 'wcap_save_connector_settings' AJAX endpoint. By manipulating the parameters of this request, the attacker can overwrite existing SMTP configuration settings to point toward a rogue mail server controlled by the attacker. Once the malicious SMTP configuration is persisted, the plugin's legitimate transactional mail processes, specifically those related to administrative password resets or abandoned cart notifications, are routed through the attacker's infrastructure.\nBecause the 'Abandoned Cart Pro' plugin utilizes an auto-login mechanism by default, it generates specialized login links sent via email to recover or manage customer/administrator sessions. By intercepting these emails at the malicious SMTP relay, the attacker gains direct access to sensitive auto-login tokens. Upon clicking these intercepted links, the attacker is automatically authenticated as an administrator, bypassing standard password authentication and MFA protocols. The impact of this exploit is catastrophic, as it grants the attacker full administrative dashboard access, allowing for the installation of malicious plugins, modification of database records, and complete control over the WordPress host environment.\nThe vulnerability is pervasive across all versions up to 10.7.1, and the lack of network-level restrictions or internal validation checks exacerbates the risk, as the exploitation occurs entirely within the standard WordPress AJAX framework, making it difficult to detect through traditional perimeter firewalls without specific application-layer inspection. The failure to apply 'current_user_can()' checks within the vulnerable functions serves as the primary technical failure point allowing this escalation path."
}