Abandoned Cart Pro For Woocommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:tyche_softwares:abandoned_cart_pro_for_woocommerce:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Tyche Softwares (93a72224-8e6c-52ef-8409-1e2a50a7672f) |
|---|---|
| Product | Abandoned Cart Pro For Woocommerce (87ea7d44-737a-56b4-bc1e-48ab72f6f453) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-81543 |
vulnerable | 2026-09-16 04:32:48.513117 |
Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
HIGH (8.8)
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify SMTP connector settings to route administrator recovery emails through an attacker-controlled server and intercept auto-login links to gain full administrative access. The plugin's auto-login feature must be enabled, which is the default configuration.
Published: 2026-09-05T07:38:15.360Z
Updated: 2026-09-07T11:17:24.505Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-4387 |
vulnerable | 2026-06-08 07:29:16.188446 |
Abandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File Upload
HIGH (8.8)
The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may allow for either remote or local code execution depending on the server configuration.
Published: 2025-06-10T03:41:37.630Z
Updated: 2026-04-08T16:55:47.915Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.