Abandoned Cart Pro for WooCommerce plugin versions up to and including 10.8.0 suffer from an authentication bypass vulnerability due to insecure encryption and HMAC implementation. Attackers can exploit this flaw to forge cart-recovery tokens and gain unauthorized access to any user's account, including administrators. The vulnerability arises from the use of MAC-free AES-CTR encryption with a user-controlled key and an HMAC check that can be bypassed by omitting a parameter. The plugin's auto-login feature is enabled by default and forced on during upgrades, increasing exploitability.
Abandoned Cart Pro for WooCommerce plugin versions up to 10.8.0 are vulnerable to an unauthenticated SQL Injection via the 'validate' parameter. This vulnerability allows attackers to append arbitrary SQL queries due to insufficient input escaping and lack of proper query preparation. The plugin uses AES-CTR encryption which is malleable, enabling attackers who obtain a legitimate token to forge SQL-carrying ciphertexts. Although an HMAC check was introduced in version 10.4.1, it is only enforced when the 'wcap_nonce' parameter is present, allowing attackers to bypass it by omitting this parameter.
Abandoned Cart Pro for WooCommerce plugin versions up to and including 10.8.0 contain a critical SQL Injection vulnerability. The flaw arises from improper sanitization of user input in the update_guest_persistent_cart() function, allowing unauthenticated attackers to inject SQL commands via the guest cart persistent meta_value. This vulnerability enables attackers to extract sensitive data and escalate privileges by modifying usermeta entries, including elevating arbitrary accounts to administrator.
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.
CVE-2026-66682 is a critical vulnerability in Tyche Softwares' Abandoned Cart Pro for WooCommerce plugin, affecting versions up to and including 10.4.0. It allows unauthenticated users to escalate privileges incorrectly due to improper privilege assignment. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
Vulnerability in Tyche softwares Product Delivery Date for WooCommerce – Lite.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through 2.7.0.
The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may allow for either remote or local code execution depending on the server configuration.
The Booking & Appointment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_google_calendar_data' function in versions up to, and including, 6.9.0. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily.
Missing Authorization vulnerability in Tyche Softwares Product Delivery Date for WooCommerce – Lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through 2.7.2.
Missing Authorization vulnerability in Tyche Softwares Arconix Shortcodes allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Arconix Shortcodes: from n/a through 2.1.11.
Missing Authorization vulnerability in Tyche Softwares Arconix FAQ allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Arconix FAQ: from n/a through 1.9.4.
Missing Authorization vulnerability in Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce.This issue affects Payment Gateway Based Fees and Discounts for WooCommerce: from n/a through 2.12.1.
Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Product Input Fields for WooCommerce.This issue affects Product Input Fields for WooCommerce: from n/a through 1.7.0.
Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Currency per Product for WooCommerce.This issue affects Currency per Product for WooCommerce: from n/a through 1.6.0.
Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce.This issue affects Order Delivery Date for WooCommerce: from n/a through 3.20.2.