{"id":"CVE-2026-116059","kind":"vulnerability","aliases":["CVE-2026-116059"],"related":[],"title":"LetsRecover WooCommerce Abandoned Cart plugin (<= 1.2.0): unauthenticated SQL injection, no fix, plugin closed","description":"The LetsRecover  WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database column name in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to append SQL to the query and read arbitrary data from the database, which is then returned through a second unauthenticated action.","summary":"The LetsRecover WordPress plugin through 1.2.0 passes an unsanitized user-supplied value into a database column name in an unauthenticated AJAX action. An attacker without an account can append SQL to the query and read arbitrary database data, returned through a second unauthenticated action.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"LetsRecover","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"letsrecover-woocommerce-abandoned-cart","fixed":[],"affected":"<= 1.2.0","ecosystem":"wordpress"}],"ecosystems":["vendor"],"tags":["auth-not-required","letsrecover","package","plugin","sql-injection","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Plugin slug is letsrecover-woocommerce-abandoned-cart (shown as LetsRecover). Run: wp plugin list --fields=name,status,version, or look in wp-content/plugins/letsrecover-woocommerce-abandoned-cart/ (Version in the main plugin file or readme.txt). Any installed version up to 1.2.0 (the latest) is affected; check inactive copies too.","fix":"No fixed version known. Latest release 1.2.0 is the affected one; the plugin is closed on WordPress.org (since Oct 28, 2026, pending review). Deactivate and delete it until a patched release exists.","status":"open","published_at":"2026-11-13T06:16:52+00:00","first_seen_at":"2026-11-13T06:42:15+00:00","triaged_at":"2026-11-13T06:42:39+00:00","updated_at":"2026-11-13T06:48:02+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T06:42:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"LetsRecover WordPress plugin: unauthenticated SQL injection leaks database contents","impact":"high","summary":"The LetsRecover WordPress plugin through 1.2.0 passes an unsanitized user-supplied value into a database column name in an unauthenticated AJAX action. An attacker without an account can append SQL to the query and read arbitrary database data, returned through a second unauthenticated action.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","letsrecover"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads arbitrary database contents, including credentials and user data","analyst_note":"Confirm the fixed version and vendor advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116059 and the plugin's WordPress.org page.","how_to_check":"- Check whether the LetsRecover plugin is installed and its version is `1.2.0` or earlier, in the WordPress admin under Plugins or in the `wp-content/plugins/` directory.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"LetsRecover","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the LetsRecover WordPress plugin version 1.2.0 or earlier are exposed, because the flaw is reachable without logging in. The sources do not say whether a non-default configuration is required. Sites that do not have this plugin installed are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4559,"output_tokens":609,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116059 and the plugin's WordPress.org page.","search":"'-116059':16A,19A '-2026':15A,18A '1.2.0':6A,43B,88C 'abandon':3A 'abandoned':24A 'account':65B 'action':60B,82B,111C,136C 'ajax':59B,110C 'allow':112C 'append':67B,116C 'arbitrari':74B,123C 'attack':62B,114C 'auth':27B 'auth-not-requir':26B 'cart':4A,25A 'close':13A 'column':54B,103C 'cve':14A,17A 'data':76B,124C 'databas':53B,75B,102C,127C 'fix':11A 'inject':9A,35B 'letsrecov':1A,30B,39B,84C 'letsrecover':20A,22A 'letsrecover-woocommerce-abandoned-cart':21A 'name':55B,104C 'one':106C 'packag':31B 'pass':44B 'plugin':5A,12A,32B,41B,86C 'queri':71B,120C 'read':73B,122C 'requir':29B 'return':77B,131C 'sanit':91C 'second':80B,134C 'sql':8A,34B,68B,117C 'sql-inject':33B 'suppli':49B,95C 'unauthent':7A,58B,81B,109C,113C,135C 'unsanit':46B 'use':99C 'user':48B,94C 'user-suppli':47B,93C 'valu':50B,96C 'without':63B 'woocommerc':2A,36B 'woocommerce':23A 'wordpress':37B,40B,85C","nicknames":[],"mitigations":[],"who_affected":"WordPress/WooCommerce sites with the LetsRecover abandoned-cart plugin (slug letsrecover-woocommerce-abandoned-cart) at version 1.2.0 or earlier. An unauthenticated visitor can inject SQL via an AJAX action and read database contents through a second unauthenticated action. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["letsrecover","letsrecoverwoocommerceabandonedcart"],"ptokens":["abandoned","cart","letsrecover","woocommerce"],"labels":["authnotrequired","high","letsrecover","package","plugin","sqlinjection","vendor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-116059':16A,19A '-2026':15A,18A '1.2.0':6A 'abandon':3A 'abandoned':24A 'cart':4A,25A 'close':13A 'cve':14A,17A 'fix':11A 'inject':9A 'letsrecov':1A 'letsrecover':20A,22A 'letsrecover-woocommerce-abandoned-cart':21A 'plugin':5A,12A 'sql':8A 'unauthent':7A 'woocommerc':2A 'woocommerce':23A","search_b":"'1.2.0':43B 'account':65B 'action':60B,82B 'ajax':59B 'append':67B 'arbitrari':74B 'attack':62B 'auth':27B 'auth-not-requir':26B 'column':54B 'data':76B 'databas':53B,75B 'inject':35B 'letsrecov':30B,39B 'name':55B 'packag':31B 'pass':44B 'plugin':32B,41B 'queri':71B 'read':73B 'requir':29B 'return':77B 'second':80B 'sql':34B,68B 'sql-inject':33B 'suppli':49B 'unauthent':58B,81B 'unsanit':46B 'user':48B 'user-suppli':47B 'valu':50B 'without':63B 'woocommerc':36B 'wordpress':37B,40B","search_c":"'1.2.0':88C 'action':111C,136C 'ajax':110C 'allow':112C 'append':116C 'arbitrari':123C 'attack':114C 'column':103C 'data':124C 'databas':102C,127C 'letsrecov':84C 'name':104C 'one':106C 'plugin':86C 'queri':120C 'read':122C 'return':131C 'sanit':91C 'second':134C 'sql':117C 'suppli':95C 'unauthent':109C,113C,135C 'use':99C 'user':94C 'user-suppli':93C 'valu':96C 'wordpress':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116059","severity":null,"published_at":"2026-11-13T06:16:52+00:00","modified_at":"2026-11-13T06:16:52+00:00","first_seen_at":"2026-11-13T06:42:15+00:00","fetched_at":"2026-11-13T06:42:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116059:3829","url":"https://wpscan.com/vulnerability/4a15043f-99f3-4ba5-aecf-c9eec77220a3/","severity":null,"published_at":"2026-11-13T06:48:02+00:00","modified_at":"2026-11-13T06:48:02+00:00","first_seen_at":"2026-11-13T06:48:02+00:00","fetched_at":"2026-11-13T06:48:02+00:00","note":"WPScan (CVE source, researcher Naoki Kawahigashi, CVSS 8.6) lists no known fix, PoC withheld until 2027-02-09; WordPress.org shows plugin closed since 2026-10-28, latest 1.2.0. Not exploited per sources. Not marked verified: no vendor advisory exists. Older CVE-2022-4357 (fixed 1.2.0) is a different bug.","cites":["https://wpscan.com/vulnerability/4a15043f-99f3-4ba5-aecf-c9eec77220a3/","https://wordpress.org/plugins/letsrecover-woocommerce-abandoned-cart/"]}],"documents":[{"id":143482,"url":"https://wpscan.com/vulnerability/4a15043f-99f3-4ba5-aecf-c9eec77220a3/","title":"LetsRecover <= 1.2.0 – Unauthenticated SQL Injection (WPScan)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":143483,"url":"https://wordpress.org/plugins/letsrecover-woocommerce-abandoned-cart/","title":"letsrecover-woocommerce-abandoned-cart on WordPress.org (closed)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}