WooCommerce Abandoned Cart Pro ATO (CVE-2026-97657): Forged Recovery Links and wp_set_auth_cookie

Recovery links are login buttons

CVE-2026-97657 affects Abandoned Cart Pro for WooCommerce (Tyche Softwares) ≤ 10.8.0. CVSS 3.1 9.8 Critical, CWE-639 — an unauthenticated attacker with one legitimate cart recovery URL can forge a token and log in as another customer, including shop administrators who abandoned a cart while logged in.

Public PoC: CVE-2026-97657 on pocbit.org. Repository: murrez/CVE-2026-97657.

| | | |---|---| | Affected | ≤ 10.8.0 | | Fix | Upgrade above 10.8.0 when vendor release is available | | Verify marker | POCBIT-97657-OK (PoC session check) |

Mechanism (defender view)

Cart checkout_link recovery uses AES-256-CTR tokens (8-byte nonce + ciphertext). The plugin loads encrypt_key from the request’s user_email. HMAC / wcap_nonce is validated only when wcap_nonce is present — omitting it skips integrity checks.

After decryption, abandoned_id (cart row primary key) is applied without binding to the email that owns that row. With auto-login on recovery (default), WordPress calls wp_set_auth_cookie() for the victim user_id tied to the forged cart ID.

CTR malleability: XOR the ciphertext so the plaintext cart ID changes from your row to the victim’s — equal string length required (zero-pad IDs like 0383 → 0001).

This is not generic WooCommerce core — only sites running Abandoned Cart Pro with vulnerable versions and checkout_link emails enabled.

Cross-read: authentication bypass — what to check, WordPress security checklist (2026), API security JWT mistakes.

Defender checklist

| # | Action | Detail | |---|--------|--------| | 1 | Inventory plugin | woocommerce-abandon-cart-pro / readme Stable tag | | 2 | Upgrade | > 10.8.0 per Wordfence / vendor advisory | | 3 | Mitigate interim | Disable auto-login on recovery links in plugin settings | | 4 | WAF (bridge) | Rate-limit wacp_action=checkout_link + validate | | 5 | Audit sessions | Admins who use storefront accounts — treat cart emails as secrets | | 6 | Lab validate | PoC check → controlled forge on staging with your own recovery link |

FAQ

We use Abandoned Cart Lite — affected?

This CVE targets Pro ≤ 10.8.0. Lite had separate HMAC hardening in 6.8.3 — still verify your exact product and version.

Is the recovery URL secret?

Treat it like a password reset link. Anyone with the URL and knowledge of cart row IDs can attack vulnerable builds.

Bottom line

CVE-2026-97657 turns marketing recovery emails into account takeover when crypto and authorization checks fail together. Patch Pro, turn off auto-login until fixed, and upgrade WooCommerce plugin hygiene alongside your next CVE Detector WordPress review.