Abandoned Cart Pro flaw lets attackers log in as an admin

Q: How can I tell whether someone got into my store through Abandoned Cart Pro?

In cPanel's Terminal, wp user list --role=administrator lists every administrator, and wp user session list with a username shows active sessions with login time and IP address. Look for an account you do not know or a customer who has suddenly become an administrator. WordPress keeps no login history, so you only see sessions that have not yet expired.

# TagsSecurityWooCommerce

The WPhost team15 Oct 20268 min read

On 13 October 2026 the WPScan and Patchstack databases listed three vulnerabilities in Abandoned Cart Pro for WooCommerce, the paid abandoned cart plugin from Tyche Softwares, and on 14 October they reached the NVD. The most serious one (CVE-2026-97657) lets a visitor without an account log in to the store as another user, administrators included. All versions up to and including 10.8.0 are affected. The fix is in version 10.8.1, which Tyche released on 8 October. Wordfence, which filed the CVE records, rates the two worst at 9.8 on the CVSS scale ("critical").

Why a forged recovery link is dangerous

The plugin emails reminders to customers who put products in the cart but did not finish the order. The link in the email takes them back to the cart, and if the customer has an account, the plugin logs them in automatically, with no password. According to the CVE record, this auto-login is on by default and is switched back on whenever the plugin is updated.

In versions up to 10.8.0 such a link can be forged. The attacker abandons a cart with their own email address and uses the genuine link in the reminder to build a link to someone else's cart. The check that should stop it is skipped when one of the parameters is simply left out. Once the attacker opens the link, they are logged in as the owner of the cart. This applies to every user who has ever abandoned a cart in the store, administrators included.

The second vulnerability (CVE-2026-97668, also 9.8) is SQL injection, a way of slipping foreign code into the plugin's database queries, here through the fields a guest fills in at checkout. According to the CVE record, it can turn any account into an administrator. The third (CVE-2026-102251, 7.5) lets an attacker pull data out of the database. Our guide to CVSS scores explains what a 9.8 means.

Since 14 October, exploit code for the first vulnerability has been public. Patchstack calls it highly dangerous and expects it to be exploited. As of 15 October, none of the sources below reports actual attacks.

Is your store affected?

Your store is affected if it runs Abandoned Cart Pro for WooCommerce up to and including version 10.8.0. The plugin is not in the wordpress.org directory, and according to Tyche its updates only show once the license is activated, so a missing update notice does not mean you are up to date. Check it in Plugins > Installed Plugins or with the command below in cPanel's Terminal. The WP-CLI guide explains how to work with WP-CLI.

Bash

# cPanel > Terminal, in the site's folder
# Read-only. Shows the abandoned cart plugins.
wp plugin list --fields=name,title,status,version \
  | grep -i abandon

The paid plugin is the line woocommerce-abandon-cart-pro. The line woocommerce-abandoned-cart is the free Abandoned Cart Lite for WooCommerce from wordpress.org, also by Tyche. It is a separate plugin and the CVE records do not list it. In version 6.9.0 of 15 October, though, Tyche tightened the recovery link check there as well, so update it too.

How to update the plugin

Back up the files and the database, as described in the backup guide.
If the license is active (it is entered under Abandoned Carts > Settings > License), Plugins > Installed Plugins shows a notice for the new version. Click Update Now.
If there is no notice, download the latest version from the Purchase History in your Tyche account. Following Tyche's instructions, unzip it and upload the folder to wp-content/plugins over FTP, overwriting the old files.
Check that the version is now 10.8.1 or later.
If you cannot update right away, deactivate the plugin until you can. The reminders will stop, but so will the vulnerable code.

If the update was late

If the store was still on 10.8.0 or older when the vulnerabilities went public, check whether anyone has logged in who should not have. The first command below lists every administrator. Look for an account you do not know, or a customer who has suddenly become an administrator. The second shows one administrator's active sessions, with the login time and IP address.

Bash

# cPanel > Terminal, in the site's folder
# Read-only. Lists administrators and one admin's sessions.
wp user list --role=administrator \
  --fields=ID,user_login,user_email,user_registered
wp user session list ADMIN_LOGIN

Replace ADMIN_LOGIN with a username from the first list and repeat for each administrator. WordPress keeps no login history, so you only see sessions that have not expired yet. Finding nothing does not prove there was no attempt.

What we do

With vulnerability (CVE) monitoring we match the plugins, theme and WordPress on your site against the vulnerability (CVE) databases every day. As soon as a vulnerability appears in something you use, we send you an alert, and we try the update on a copy in staging first. If the check above turns up an administrator you do not know, with hacked site cleanup we remove the malware and the backdoors. We do both for your site wherever it is hosted.

Frequently asked questions

What vulnerabilities were found in Abandoned Cart Pro for WooCommerce?

Three, listed in the WPScan and Patchstack databases on 13 October 2026 and in the NVD on 14 October. The most serious, CVE-2026-97657, lets a visitor without an account log in to the store as another user, administrators included. CVE-2026-97668 is SQL injection that according to its record can turn any account into an administrator, and CVE-2026-102251 lets an attacker pull data out of the database.

Which version of Abandoned Cart Pro fixes the vulnerabilities?

Abandoned Cart Pro for WooCommerce 10.8.1, released by Tyche Softwares on 8 October 2026. All versions up to and including 10.8.0 are affected. After updating, check under Plugins > Installed Plugins that the version is 10.8.1 or later.

How can an abandoned cart email link give someone access to my store?

Abandoned Cart Pro emails reminders with a link back to the cart, and if the customer has an account it logs them in automatically with no password. In versions up to 10.8.0 such a link can be forged, because the check is skipped when one of the parameters is simply left out. The attacker abandons a cart with their own email and uses the genuine link to build one to someone else's cart, which logs them in as its owner.

Why do I see no update notice for Abandoned Cart Pro?

Abandoned Cart Pro is not in the wordpress.org directory, and according to Tyche its updates only show once the license is activated. So a missing notice does not mean the plugin is up to date. The license goes under Abandoned Carts > Settings > License, and without it the latest version is downloaded from Purchase History in your Tyche account and uploaded over FTP to wp-content/plugins.

Is the free Abandoned Cart Lite affected?

The CVE records do not list Abandoned Cart Lite for WooCommerce, a separate plugin on wordpress.org from the same author. In version 6.9.0 of 15 October 2026, though, Tyche tightened the recovery link check there too, so update it as well.

Is the Abandoned Cart Pro vulnerability being exploited?

Since 14 October 2026 exploit code for the first vulnerability has been public, and Patchstack calls it highly dangerous and expects it to be exploited. As of 15 October, none of the sources reports actual attacks.

How can I tell whether someone got into my store through Abandoned Cart Pro?

In cPanel's Terminal, wp user list --role=administrator lists every administrator, and wp user session list with a username shows active sessions with login time and IP address. Look for an account you do not know or a customer who has suddenly become an administrator. WordPress keeps no login history, so you only see sessions that have not yet expired.

Is deleting the unknown administrator enough?

No. With that level of access the attacker may have left a backdoor. Change the administrators' passwords, end their sessions with the Log Out Everywhere button on each profile, and then clean the site as a hacked one.

Sources