CVE-2026-102251: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Tyche Softwares Abandoned Cart Pro for WooCommerce

CVE-2026-102251 is an SQL Injection vulnerability in Tyche Softwares' Abandoned Cart Pro for WooCommerce plugin affecting all versions up to 10.8.0. The issue arises from improper neutralization of special elements in SQL commands via the 'validate' parameter, which is insufficiently escaped and lacks prepared statements. Attackers can append additional SQL queries to extract sensitive database information without authentication. The use of AES-CTR encryption is malleable, enabling attackers who control an abandoned cart email to recover the keystream and forge arbitrary SQL ciphertexts. The HMAC check added in version 10.4.1 is conditional on the presence of the 'wcap_nonce' parameter, and omitting this parameter bypasses the check entirely.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not allow integrity or availability impacts but compromises confidentiality. The malleability of the AES-CTR encryption used in token generation further facilitates crafting malicious SQL queries. This poses a high risk to data confidentiality for affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin functionality. The HMAC check introduced in version 10.4.1 is only effective when the 'wcap_nonce' parameter is present; omitting this parameter bypasses the check, so relying solely on this mitigation is insufficient.