- Critical 9.8
CVE-2026-97657
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens, where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` GET parameter, combined with an HMAC nonce check in `wcap_email_track_links()` that is only enforced when the `wcap_nonce` parameter is non-empty, allowing complete bypass by omiss…
Scores
The facts
- Published
- 14 October 2026
- Last changed
- 14 October 2026
- NVD status
- Deferred
- Severity
- Critical, CVSS 9.8 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- Known exploited
- Not in the CISA Known Exploited Vulnerabilities catalogue in this build.
- EPSS
- 0.4% chance of exploitation activity in the next 30 days (percentile 30).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.