CVE-2026-102251: Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. AES-CTR is a malleable stream cipher, so an attacker who obtains one legitimate token by abandoning a cart with an email address they control can recover the keystream and forge a ciphertext carrying arbitrary SQL. The HMAC check added in 10.4.1 is enforced only when the wcapnonce parameter is present, so omitting the parameter skips it entirely.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need to obtain one legitimate token, which they can do by abandoning a cart using an email address they control, then can forge ciphertext containing arbitrary SQL; omitting the wcap_nonce parameter bypasses the HMAC check.
Which installations are affected?
All versions of Abandoned Cart Pro for WooCommerce up to and including 10.8.0 are affected. The issue is reachable over the network and does not require privileges, according to the supplied severity vector.
What is the likely impact of successful exploitation?
Successful exploitation can allow an attacker to append SQL to an existing query and extract sensitive information from the WordPress database. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.