Vulnerability Description
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://woocommerce.com/products/abandoned-cart-pro/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d8aa73-2e68-4353-a60
FAQ
What is CVE-2026-81543?
CVE-2026-81543 is a vulnerability with a CVSS score of 8.8 (HIGH). The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verif...
How severe is CVE-2026-81543?
CVE-2026-81543 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-81543?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.