CVE-2026-97657: CWE-639 Authorization Bypass Through User-Controlled Key in Tyche Softwares Abandoned Cart Pro for WooCommerce

The vulnerability in Tyche Softwares' Abandoned Cart Pro for WooCommerce (<=10.8.0) arises from the use of MAC-free AES-CTR encryption for cart-recovery tokens, where the encryption key is derived from a user-controllable 'user_email' GET parameter. The 8-byte CTR nonce is included inside the ciphertext, and the HMAC nonce check in 'wcap_email_track_links()' is only enforced if the 'wcap_nonce' parameter is present, allowing bypass by omission. Additionally, the decrypted 'abandoned_id' is used without ownership verification, enabling attackers who possess a legitimate cart-recovery link to recover the keystream, forge ciphertexts for any victim's cart ID, and trigger 'wp_set_auth_cookie()' to log in as that user. This leads to full account takeover, including administrators. The auto-login feature is enabled by default and forced on during plugin upgrades, increasing the risk of exploitation.

An unauthenticated attacker can achieve full account takeover of any user who has abandoned a cart, including administrators, by forging cart-recovery tokens and bypassing authentication controls. This compromises confidentiality, integrity, and availability of user accounts and potentially the entire WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, disabling the auto-login feature or the plugin itself may reduce exposure. Monitor vendor channels for updates and apply official patches once released.