CVE-2026-97668: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Tyche Softwares Abandoned Cart Pro for WooCommerce

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to and including 10.8.0. The vulnerability stems from insufficient escaping of user-supplied data and lack of prepared statements in the update_guest_persistent_cart() function. Specifically, the abandoned_cart_info value, sourced from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an SQL UPDATE statement on the wp_usermeta table. While adjacent SELECT and INSERT queries use prepared statements, this UPDATE query does not, enabling unauthenticated attackers to append arbitrary SQL. This allows extraction of sensitive data through time-based blind SQL injection and modification of usermeta rows, demonstrated by escalating an arbitrary account to administrator by overwriting the wp_capabilities row.

Successful exploitation can lead to full compromise of the WordPress site by unauthorized privilege escalation to administrator. Additionally, attackers can extract sensitive database information via blind SQL injection techniques. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS score of 9.8 (critical).

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected plugin and monitor for suspicious activity related to usermeta modifications. Avoid using affected versions (<=10.8.0) in production environments.