What’s Vulnerable › Vulnerabilities
CVE-2026-96901: Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token
- Severity: low (CVSS 3.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-21 · updated 2026-10-21
- Weakness: CWE-287
Description
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.
Affected products
- Cart Abandonment Recovery for WooCommerce: before 2.2.0 — fixed in 2.2.0
How to fix
Upgrade to a fixed version: Cart Abandonment Recovery for WooCommerce 2.2.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-96901 or the next vulnerability affects your stack