{"id":"CVE-2026-96901","kind":"vulnerability","aliases":["CVE-2026-96901"],"related":[],"title":"Cart Abandonment Recovery for WooCommerce: unsigned tokens let attackers alter carts","description":"The Cart Abandonment Recovery for WooCommerce  WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.","summary":"The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 accepts an unsigned legacy cart-recovery token format and does not verify token integrity. An unauthenticated attacker who knows a victim's cart session identifier can change that victim's abandoned-cart record, such as unsubscribing them from recovery emails or applying an arbitrary coupon.","severity":"low","cvss":3.7,"epss":0.00158,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","woocommerce","wordpress"],"not_affected_if":["plugin-version-2.2.0-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get cart-abandonment-recovery --field=version` (slug unknown from sources, confirm it)\n- Look for the plugin's legacy token handling in its code; the sources do not say which file or setting controls the unsigned format","fix":"- Update the Cart Abandonment Recovery for WooCommerce plugin to `2.2.0` or later\n- Unknown whether disabling the legacy token format is possible without upgrading","status":"open","published_at":"2026-10-21T06:16:51+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:43:35+00:00","updated_at":"2026-10-25T04:43:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:43:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Cart Abandonment Recovery for WooCommerce plugin to `2.2.0` or later\n- Unknown whether disabling the legacy token format is possible without upgrading","reach":"internet","title":"Cart Abandonment Recovery for WooCommerce: unsigned tokens let attackers alter carts","impact":"low","summary":"The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 accepts an unsigned legacy cart-recovery token format and does not verify token integrity. An unauthenticated attacker who knows a victim's cart session identifier can change that victim's abandoned-cart record, such as unsubscribing them from recovery emails or applying an arbitrary coupon.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker alters victim's abandoned-cart record, unsubscribing or applying coupons","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get cart-abandonment-recovery --field=version` (slug unknown from sources, confirm it)\n- Look for the plugin's legacy token handling in its code; the sources do not say which file or setting controls the unsigned format","needs_analyst":false,"not_affected_if":["plugin-version-2.2.0-or-later"],"who_is_affected":"Sites running the Cart Abandonment Recovery for WooCommerce plugin older than 2.2.0 that use its cart-recovery emails. The attacker needs to know a victim's cart session identifier, which the sources do not say how often is obtainable. Sites without this plugin, or already on 2.2.0 or later, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000671,"input_tokens":3413,"output_tokens":659,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-96901':14A,17A '2.2.0':31B,88C 'abandon':2A,24B,64B,81C,129C 'abandoned-cart':63B,128C 'accept':32B,106C 'act':101C 'allow':112C 'alter':10A 'appli':75B,140C 'arbitrari':77B,142C 'attack':9A,49B,114C 'cart':1A,11A,23B,37B,55B,65B,80C,97C,120C,130C,147C 'cart-recoveri':36B,96C 'chang':59B 'coupon':78B,143C 'cve':12A,15A 'ecommerc':18B 'email':73B,138C 'exampl':133C 'format':40B,111C 'identifi':57B,122C 'integr':46B,93C 'know':51B,116C 'legaci':35B,109C 'let':8A 'modifi':124C 'packag':19B 'plugin':29B,86C 'record':66B,131C 'recoveri':3A,25B,38B,72B,82C,98C,137C 'restor':146C 'session':56B,121C 'still':105C 'token':7A,39B,45B,99C,110C 'unauthent':48B,113C 'unsign':6A,34B,108C 'unsubscrib':69B,134C 'verifi':44B,91C 'victim':53B,61B,118C,126C 'woocommerc':5A,20B,27B,84C 'wordpress':21B,28B,85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Cart Abandonment Recovery for WooCommerce plugin older than 2.2.0 that use its cart-recovery emails. The attacker needs to know a victim's cart session identifier, which the sources do not say how often is obtainable. Sites without this plugin, or already on 2.2.0 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96901","severity":null,"published_at":"2026-10-21T06:16:51+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96901","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96901","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}