Unauthenticated CSRF in Abandoned Cart Lite for WooCommerce

Executive Summary

CVE-2026-57637 is a Cross Site Request Forgery (CSRF) vulnerability affecting the WordPress plugin "Abandoned Cart Lite for WooCommerce" versions up to and including 6.8.0.

This vulnerability allows an attacker to trick a logged-in user into performing unwanted actions by making them click a malicious link or visit a crafted webpage.

The attacker can force higher privileged users to execute actions without their consent while they are authenticated.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to perform unauthorized actions on your WooCommerce site if a privileged user interacts with a malicious link or page.

Such actions could be executed under the authenticated user's privileges, potentially leading to unwanted changes or disruptions in your e-commerce operations.

However, the severity is considered low with a CVSS score of 4.3, and it requires user interaction to be exploited.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability affects Abandoned Cart Lite for WooCommerce versions up to and including 6.8.0.

To mitigate this vulnerability, users should update the plugin to version 6.8.1 or later, where the issue has been patched.

Updating the plugin will prevent attackers from exploiting the Cross Site Request Forgery (CSRF) vulnerability.

Useful 0 Not Useful 0