CVE-2026-97668: Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent metavalue in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the updateguestpersistentcart() function. The abandonedcartinfo value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wpusermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wpcapabilities row that shadows the legitimate one.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An unauthenticated remote attacker can exploit it. No WordPress account, elevated privilege, or user interaction is required.
What attacker-controlled input reaches the vulnerable query?
The vulnerable abandoned_cart_info value is populated from attacker-controlled checkout fields, including the SMS consent field. That value is processed with stripslashes() and concatenated into an UPDATE query against the wp_usermeta table.
What could an attacker do after successful exploitation?
An attacker can use time-based blind SQL injection techniques to extract sensitive database information and can modify usermeta rows. The issue has been demonstrated to elevate an arbitrary account to administrator by writing a shadowing wp_capabilities row.
Are affected versions limited to a particular configuration?
The issue affects all versions through 10.8.0. The available information identifies guest persistent-cart handling and attacker-controlled checkout fields as the affected path.