EXPOSURES › CVE-2026-97668
CVE-2026-97668
CRITICALThe Abandoned Cart Pro for WooCommerce plugin is vulnerable to SQL injection allowing unauthenticated attackers to extract data and escalate privileges to administrator.
An unauthenticated attacker can exploit insufficient escaping and direct concatenation of user-supplied data into an UPDATE statement to extract sensitive information via blind SQL injection and escalate privileges by writing a wp_capabilities row. DIB organizations must ensure all third-party plugins and components are patched promptly, as this flaw demonstrates how a single unpatched plugin can compromise an entire WordPress site, leading to data breaches and compliance violations.
Shame score — The vulnerability allows unauthenticated attackers to escalate privileges to administrator and extract data, indicating a severe lack of secure coding practices and delayed patching.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.