CVE-2026-39470
Deferred Deferred - Pending Action
Shop Manager Privilege Escalation in WooCommerce Cart Abandonment Recovery

Publication date: 2026-06-15

Last updated on: 2026-06-15

Assigner: Patchstack

Description
Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-15
Last Modified
2026-06-15
Generated
2026-06-16
AI Q&A
2026-06-16
EPSS Evaluated
N/A
NVD
CVE-2026-39470
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
woocommerce cart_abandonment_recovery to 2.1.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a privilege escalation issue affecting the Shop Manager role in versions of the WooCommerce Cart Abandonment Recovery plugin prior to 2.1.0.

Impact Analysis

An attacker exploiting this vulnerability could escalate their privileges, potentially gaining higher access rights than intended. This could lead to full control over the affected system's confidentiality, integrity, and availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39470. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart