CVE-2026-97668
9.8CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-89
Impact
Unauthenticated attackers can extract database records or achieve full administrator privilege escalation via remote HTTP requests. They only need access to exposed checkout endpoints with guest cart handling.
Root cause
The update_guest_persistent_cart() function directly concatenates attacker-controlled guest cart meta values into an SQL UPDATE statement without using prepared statements.
Affected systems
Abandoned Cart Pro for WooCommerce plugin for WordPress versions up to and including 10.8.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Abandoned Cart Pro for WooCommerce to a version newer than 10.8.0. If you cannot patch immediately, deactivate the plugin via WP-CLI or the WordPress admin panel.
$ wp plugin deactivate woocommerce-abandoned-cart-proAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.