CVE-2026-96901 Details
Description
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.
An authentication bypass vulnerability has been identified in the Cart Abandonment Recovery for WooCommerce WordPress plugin, affecting versions prior to 2.2.0. The vulnerability arises because the plugin does not properly verify the integrity of its cart-recovery token before use and continues to accept an unsigned legacy token format. This flaw allows unauthenticated attackers who are aware of a victim's cart session identifier to alter that victim's abandoned-cart record. For instance, attackers could unsubscribe the victim from recovery emails or apply an arbitrary coupon to their restored cart.
Users are advised to update the Cart Abandonment Recovery for WooCommerce WordPress plugin to version 2.2.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/f00e95a2-a5fb-49da-aa6c-8c0279b6df2d/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Cart Abandonment Recovery | < 2.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |