CVE-2026-96901: Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token

Q: What does an attacker need to exploit this issue?

An attacker must know the victim's cart session identifier. No authentication is required, and the plugin accepts an unsigned legacy recovery-token format.

Q: Which installations are affected?

Cart Abandonment Recovery for WooCommerce versions before 2.2.0 are affected. The issue involves acceptance of unsigned legacy recovery tokens.

Q: What could an attacker change in an affected victim's abandoned-cart record?

An attacker can modify the victim's abandoned-cart record, including unsubscribing the victim from recovery emails or applying an arbitrary coupon to the victim's restored cart.

Published Oct 21, 2026

Updated

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.

Affected Software

1 affected component

CartFlows Cart Abandonment Recovery for WooCommerce<2.2.0

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker must know the victim's cart session identifier. No authentication is required, and the plugin accepts an unsigned legacy recovery-token format.

Which installations are affected?

Cart Abandonment Recovery for WooCommerce versions before 2.2.0 are affected. The issue involves acceptance of unsigned legacy recovery tokens.

What could an attacker change in an affected victim's abandoned-cart record?

An attacker can modify the victim's abandoned-cart record, including unsubscribing the victim from recovery emails or applying an arbitrary coupon to the victim's restored cart.

CVE-2026-96901: Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which installations are affected?

What could an attacker change in an affected victim's abandoned-cart record?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which installations are affected?

What could an attacker change in an affected victim's abandoned-cart record?