A critical flaw in the Abandoned Cart Pro plugin allows attackers to seize full control of WordPress sites without logging in.
Key points
- CVE-2026-97668 affects Abandoned Cart Pro versions up to 10.8.0
- The flaw is a CVSS 9.8 Critical SQL injection vulnerability
- Attackers can escalate accounts to administrators without credentials
The Abandoned Cart Pro plugin for WordPress contains a severe security flaw that allows attackers to take over site administration. This issue affects all versions of the software up to and including version 10.8.0, according to the National Vulnerability Database.
What happened
Tyche Softwares’ Abandoned Cart Pro for WooCommerce plugin is vulnerable to SQL injection in versions up to 10.8.0. The flaw, tracked as CVE-2026-97668, carries a CVSS score of 9.8, which is rated as Critical. The vulnerability exists because the plugin fails to properly escape user-supplied data in the `update_guest_persistent_cart()` function.
Attackers can exploit this by manipulating checkout fields, such as the SMS consent option. The plugin passes this data through a basic filter and concatenates it directly into an SQL update statement. This allows unauthenticated users to append malicious code to the database query.
The injection targets the `wp_usermeta` table. Researchers have demonstrated that attackers can use this flaw to extract sensitive information or modify user metadata. Specifically, they can write a new capabilities row that shadows the legitimate one, effectively granting themselves administrator privileges on the site.
Why it matters
SQL injection occurs when an application trusts user input without verifying its safety. In this case, the plugin mixed safe coding practices with unsafe ones. While some database queries used prepared statements, the update function did not. This inconsistency created a doorway for attackers to bypass authentication entirely.
Understanding this helps you see why input validation matters. Even minor forms, like checkout fields, can become attack vectors if the backend code does not sanitize the data. It highlights the risk of partial security implementations where only some functions are protected against manipulation.
The fix
- Update the Abandoned Cart Pro plugin to the latest version immediately.
- Ensure the installed version is newer than 10.8.0.
- Verify that the update resolves the SQL injection vulnerability.
- Check other plugins for similar unpatched security issues.
Why it matters
Teams usually prioritize patching plugins that handle user input directly. When a vulnerability allows unauthenticated access, the risk is immediate because attackers do not need stolen credentials. Check whether your site uses guest checkout features, as these often involve storing data from unverified users.
Regular audits of plugin versions are essential. Security teams should monitor vendor announcements for critical updates. Understanding how data flows from a form to the database helps identify weak points. This incident shows that even popular plugins can have significant gaps in their security logic.
Background: SQL injection
SQL injection occurs when untrusted data enters a query without proper separation from the command structure. This allows attackers to execute arbitrary database commands. You prevent this by using parameterized queries, which keep data and code strictly separate. Input validation helps but does not replace parameterization. Regular security regression testing catches regressions in your code logic.
Read the full guide: SQL Injection: 9 Questions Answered About Database Attacks
What to do and how to stay safe: Abandoned Cart Pro
- Check your WordPress dashboard for the Abandoned Cart Pro plugin version.
- Update the plugin if you are running version 10.8.0 or older.
- Monitor your site for unauthorized administrator accounts.
- Review database logs for unusual update statements once the vendor provides an update.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Abandoned Cart Pro are affected?
All versions up to and including 10.8.0 are vulnerable to CVE-2026-97668.
Can attackers gain admin access without a password?
Yes, unauthenticated attackers can escalate accounts to administrator level.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates the severity as 9.8 Critical.
