[ CVE-2026-96901 · Published 21 Oct 2026 ]
Vulnerability in Unknown Cart Abandonment Recovery for WooCommerce
CVSS 3.7
EPSS <1%No fix listed yet
[ Description ]Official description
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.