CVE-2026-96900

Deferred Deferred - Pending Action

Unauthenticated Cart Data Deletion in WooCommerce Abandonment Recovery

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that customer's stored abandoned-cart data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96900

EUVD

EUVD-2026-100869

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Cart	Abandonment Recovery for WooCommerce 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Cart Abandonment Recovery for WooCommerce plugin before version 2.1.4. It allows unauthenticated attackers to delete or modify abandoned cart records by exploiting the lack of verification for email ownership. If an attacker knows a customer's email address, they can tamper with or destroy that customer's stored abandoned cart data.

Detection Guidance

Check the installed version of the Cart Abandonment Recovery for WooCommerce plugin. If it is below 2.1.4, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

If you use the affected plugin version, an attacker could delete or alter your abandoned cart data by knowing your email address. This could lead to loss of cart contents, incorrect order processing, or disruption of recovery emails sent by the plugin.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modification or deletion of customer data stored in abandoned cart records. If customer data is altered or destroyed without consent, it may violate data integrity and access control requirements under these regulations.

Mitigation Strategies

Update the Cart Abandonment Recovery for WooCommerce plugin to version 2.1.4 or later immediately to patch the vulnerability. Disable the plugin temporarily if an update is not immediately available.

Hi! I’m here to help you understand CVE-2026-96900. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70