AI description
CVE-2026-81543 describes a privilege escalation vulnerability affecting the Abandoned Cart Pro for WooCommerce plugin for WordPress, specifically in all versions up to and including 10.7.1. The flaw stems from inadequate capability checks and a lack of nonce verification across several AJAX actions, including `wcap_save_connector_settings`, `wcap_send_manual_email`, `wcap_abandoned_cart_info`, and `wcap_change_manual_email_data`. This vulnerability allows authenticated attackers, even those with subscriber-level access, to alter SMTP connector settings. By doing so, they can redirect administrator recovery emails to a server they control, intercepting auto-login links and subsequently gaining complete administrative access to the WordPress site. This attack is feasible when the plugin's auto-login feature is enabled, which is its default configuration.
- Description
- The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.
- Source
- security@wordfence.com
- NVD status
- Deferred
CVSS 3.1
- Type
- Secondary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- security@wordfence.com
- CWE-269
- Hype score
- Not currently trending