CVE-2026-81543: Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcapsaveconnectorsettings, wcapsendmanualemail, wcapabandonedcartinfo, and wcapchangemanualemaildata. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the plugin auto-login feature is enabled as stated; this condition is required by the guidance provided in the material.
Abandoned Cart Pro for WooCommerce (WordPress plugin) auto-login feature = enabled (default) - Configuration
Apply the required security control for these AJAX actions so they perform capability checks and nonce verification to prevent subscriber+ privilege escalation and unauthorized modification/interception.
Abandoned Cart Pro for WooCommerce (WordPress plugin) AJAX actions wcap_save_connector_settings / wcap_send_manual_email / wcap_abandoned_cart_info / wcap_change_manual_email_data = nonce verification and capability checks
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. No user interaction is required after the attacker has access to such an account.
Is the default configuration affected?
Yes. Exploitation requires the plugin's auto-login feature to be enabled, and this feature is enabled by default.
What access could an attacker obtain?
An attacker can modify SMTP connector settings to send administrator recovery emails through an attacker-controlled server. They can intercept auto-login links from those emails and use them to gain full administrative access.
How can I assess whether my site is exposed?
Sites using Abandoned Cart Pro for WooCommerce version 10.7.1 or earlier are affected if auto-login is enabled. Review SMTP connector settings and administrator recovery-email activity for unexpected changes or delivery routing.