{"id":"CVE-2026-97668","revision":null,"records":[{"revision":"974dcab9ab884bce95f41006edb72690","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97668","aliases":[],"title":"Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value","description":"The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.","state":0,"publishedAt":"2026-10-14T02:27:37.892+00:00","modifiedAt":"2026-10-15T16:43:50.779+00:00","affected":[{"ecosystem":"Vendor product","name":"Abandoned Cart Pro for WooCommerce","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Tyche Softwares\",\n                    \"product\": \"Abandoned Cart Pro for WooCommerce\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"10.8.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/9d91ffee-6902-4553-af3b-8ef4e5199367?source=cve","https://www.tychesoftwares.com/products/woocommerce-abandoned-cart-pro-plugin/","https://www.tychesoftwares.com/docs/docs/abandoned-cart-pro-for-woocommerce-new/changelog-abandoned-cart-pro/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97668","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97668","identifiers":["CVE-2026-97668"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T15:04:17.9226009+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T15:04:17.9226009+00:00","lastSuccessAt":"2026-11-09T15:04:18.1621362+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:18.1621395+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-49ad16fb0d34ddf0ae41aa46fedfe58e1df7005677e5f3c7ea3ce3ccbb1e0589","complete":true,"records":421457,"lastAttemptAt":"2026-11-09T15:02:15.2169676+00:00","lastSuccessAt":"2026-11-09T15:02:15.1121329+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:02:15.2169676+00:00","snapshotPublishedAt":"2026-11-09T14:25:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1cda4ef84588402c81419af30caa5cf1","complete":false,"records":13655,"lastAttemptAt":"2026-11-09T15:16:31.927767+00:00","lastSuccessAt":"2026-11-09T15:16:31.919+00:00","error":"9 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T15:16:31.919+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13698,"expectedIdentifiers":13707,"failedIdentifiers":9},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T15:04:17.9226009+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T15:04:17.9226009+00:00","lastSuccessAt":"2026-11-09T15:04:18.1628494+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:18.1628497+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-122e73413fbf41e4b6ede4e4f5660885","complete":true,"records":13667,"lastAttemptAt":"2026-11-09T15:04:19.7498555+00:00","lastSuccessAt":"2026-11-09T15:04:19.744+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:19.744+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T15:04:17.5233893+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:17.5233893+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T15:02:16.0914115+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:02:16.0914115+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-c905fa1bd26c7b261e77cc7202a86dc766ff31c2b096b501f3bf44f561e34970","complete":true,"records":3063,"lastAttemptAt":"2026-11-09T15:04:17.8913143+00:00","lastSuccessAt":"2026-11-09T12:02:21.7931207+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:17.8913143+00:00","snapshotPublishedAt":"2026-11-09T11:18:00+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-c5775280c9de3927e2aad763cbfbebcc2ac79b903f8410c65ab9bc1096f5fa3d","complete":true,"records":231299,"lastAttemptAt":"2026-11-09T15:04:17.3926133+00:00","lastSuccessAt":"2026-11-09T15:04:15.9950254+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:17.3926133+00:00","snapshotPublishedAt":"2026-11-09T14:33:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}