---
id: "CVE-2026-116059"
page: "https://infrastack.ai/live/CVE-2026-116059"
kind: "vulnerability"
aliases: ["CVE-2026-116059"]
title: "LetsRecover WooCommerce Abandoned Cart plugin (<= 1.2.0): unauthenticated SQL injection, no fix, plugin closed"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "LetsRecover", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "letsrecover-woocommerce-abandoned-cart", "fixed": [], "affected": "<= 1.2.0", "ecosystem": "wordpress"}]
ecosystems: ["vendor"]
tags: ["auth-not-required", "letsrecover", "package", "plugin", "sql-injection", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-13T06:16:52+00:00"
first_seen_at: "2026-11-13T06:42:15+00:00"
updated_at: "2026-11-13T06:48:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116059", "first_seen_at": "2026-11-13T06:42:15+00:00"}, {"source": "analyst", "url": "https://wpscan.com/vulnerability/4a15043f-99f3-4ba5-aecf-c9eec77220a3/", "first_seen_at": "2026-11-13T06:48:02+00:00", "cites": ["https://wpscan.com/vulnerability/4a15043f-99f3-4ba5-aecf-c9eec77220a3/", "https://wordpress.org/plugins/letsrecover-woocommerce-abandoned-cart/"]}]
exploit_sources: []
---

# LetsRecover WooCommerce Abandoned Cart plugin (<= 1.2.0): unauthenticated SQL injection, no fix, plugin closed

Link for people: https://infrastack.ai/live/CVE-2026-116059 (this .md is for agents)

The LetsRecover WordPress plugin through 1.2.0 passes an unsanitized user-supplied value into a database column name in an unauthenticated AJAX action. An attacker without an account can append SQL to the query and read arbitrary database data, returned through a second unauthenticated action.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:LetsRecover affected range not listed fixed no fixed version listed
- wordpress:letsrecover-woocommerce-abandoned-cart affected <= 1.2.0 fixed no fixed version listed

## How to check

Plugin slug is letsrecover-woocommerce-abandoned-cart (shown as LetsRecover). Run: wp plugin list --fields=name,status,version, or look in wp-content/plugins/letsrecover-woocommerce-abandoned-cart/ (Version in the main plugin file or readme.txt). Any installed version up to 1.2.0 (the latest) is affected; check inactive copies too.

## Fix

No fixed version known. Latest release 1.2.0 is the affected one; the plugin is closed on WordPress.org (since Oct 28, 2026, pending review). Deactivate and delete it until a patched release exists.

## Timeline

- 2026-11-13T06:42:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116059
- 2026-11-13T06:48:02+00:00 analyst https://wpscan.com/vulnerability/4a15043f-99f3-4ba5-aecf-c9eec77220a3/ — WPScan (CVE source, researcher Naoki Kawahigashi, CVSS 8.6) lists no known fix, PoC withheld until 2027-02-09; WordPress.org shows plugin closed since 2026-10-28, latest 1.2.0. Not exploited per sources. Not marked verified: no vendor advisory exists. Older CVE-2022-4357 (fixed 1.2.0) is a different bug.

## Documents

- [advisory] LetsRecover <= 1.2.0 – Unauthenticated SQL Injection (WPScan) https://wpscan.com/vulnerability/4a15043f-99f3-4ba5-aecf-c9eec77220a3/
- [describes] letsrecover-woocommerce-abandoned-cart on WordPress.org (closed) https://wordpress.org/plugins/letsrecover-woocommerce-abandoned-cart/

## From the sources

The LetsRecover  WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database column name in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to append SQL to the query and read arbitrary data from the database, which is then returned through a second unauthenticated action.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_