CVE-2026-56010 describes a privilege escalation vulnerability in Tyche Softwares' Abandoned Cart Pro for WooCommerce plugin versions up to 10.4.0. The issue stems from incorrect privilege assignment (CWE-266), allowing users with subscriber privileges to escalate their access rights. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates the vulnerability is remotely exploitable over the network with low attack complexity, requiring low privileges and no user interaction, and results in high impact on confidentiality, integrity, and availability. No patch or vendor advisory detailing remediation is currently available.

Successful exploitation of this vulnerability could allow a subscriber-level user to escalate privileges, potentially gaining administrative or other elevated access within the affected WooCommerce plugin environment. This could lead to full compromise of the plugin's functionality, unauthorized data access, modification, or deletion, severely impacting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber-level user capabilities and monitoring for suspicious privilege escalations. Avoid granting subscriber access to untrusted users.