Live › vulnerability › CVE-2026-96901
Go to dashboardThe Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 accepts an unsigned legacy cart-recovery token format and does not verify token integrity. An unauthenticated attacker who knows a victim's cart session identifier can change that victim's abandoned-cart record, such as unsubscribing them from recovery emails or applying an arbitrary coupon.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Cart Abandonment Recovery for WooCommerce plugin older than 2.2.0 that use its cart-recovery emails. The attacker needs to know a victim's cart session identifier, which the sources do not say how often is obtainable. Sites without this plugin, or already on 2.2.0 or later, can skip it.
No product ranges from the sources yet.
wp plugin get cart-abandonment-recovery --field=version (slug unknown from sources, confirm it)2.2.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.
This page as .md · .json · in your agent: get_signal("CVE-2026-96901")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.