CVE-2026-96900: Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR
Published Oct 14, 2026
·Updated
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that customer's stored abandoned-cart data.
Affected Software
1 affected component
WooCommerce Cart Abandonment Recovery for WooCommerce<2.1.4
Event History
Oct 14, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker can exploit it without a WordPress account if they know the email address associated with a customer's abandoned-cart record.
2
What can an attacker do to affected abandoned-cart data?
They can delete the selected abandoned-cart record or overwrite it, which can destroy or tamper with stored abandoned-cart information.
3
Which plugin versions are affected?
Versions of Cart Abandonment Recovery for WooCommerce before 2.1.4 are affected.