Shivamani Vastrala

The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.

**Name of the Vulnerable Software and Affected Versions** Abandoned Cart Lite for WooCommerce WordPress plugin versions prior to 6.8.2 **Description** An issue exists where the plugin fails to protect the integrity of cart-recovery tokens or bind them to the requesting account. When the automatic-login option is enabled, unauthenticated attackers can forge a recovery link to log in as another user, leading to account takeover. **Recommendations** Update the plugin to version 6.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** WP DSGVO Tools (GDPR) versions prior to 3.1.40 **Description** The data subject access request feature fails to perform an authorization check on its immediate-processing path. This allows unauthenticated attackers to generate and download a full personal-data export of any user, customer, or commenter by providing their email address. The exported data includes names, postal addresses, phone numbers, emails, and comment content. **Recommendations** Update the plugin to version 3.1.40 or later.