This vulnerability, classified as CWE-266 (Incorrect Privilege Assignment), affects Abandoned Cart Pro for WooCommerce versions up to and including 10.4.0. It enables unauthenticated attackers to escalate their privileges, potentially gaining full control over the affected system. The CVSS 3.1 base score is 9.8, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been documented as of the published date, and no known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated attacker to gain elevated privileges, leading to complete compromise of the affected WooCommerce plugin environment. This includes full control over the plugin's functionality and potentially the underlying system, impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity. Avoid using affected versions in production environments if possible.