PT-2023-22450 · WordPress · Abandoned Cart Lite For Woocommerce

Ayan Saha + 2 · Published 2023-06-07 · Updated 2025-06-12 · CVE-2023-2986

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Abandoned Cart Lite for WooCommerce plugin for WordPress versions up to, and including, 5.14.2

Description The issue is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers.

Recommendations For versions up to, and including, 5.14.2, update to version 5.15.1 or later to ensure sites are no longer vulnerable through historical check-out links. Additionally, updating to version 5.15.2 will ensure null key values won't permit the authentication bypass.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2023-2986

Affected Products

Abandoned Cart Lite For Woocommerce

References · 15

• 🔥 https://github.com/Ayantaker/CVE-2023-2986 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2986 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2986 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php#L1815 · Patch
• https://plugins.trac.wordpress.org/changeset/2922242 · Patch
• https://plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php?rev=2916178#L1800 · Patch
• https://github.com/TycheSoftwares/woocommerce-abandoned-cart/pull/885#issuecomment-1601813615 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925274%40woocommerce-abandoned-cart&new=2925274%40woocommerce-abandoned-cart&sfp_email=&sfph_mail= · Note
• https://twitter.com/pdnuclei_bot/status/1933071784217391548 · Twitter Post
• https://t.me/cvenotify/51994 · Telegram Post
• https://t.me/cvenotify/52660 · Telegram Post
• https://t.me/cvenotify/52530 · Telegram Post
• https://t.me/pentestingnews/36667 · Telegram Post
• https://wordfence.com/blog/2023/06/tyche-softwares-addresses-authentication-bypass-vulnerability-in-abandoned-cart-lite-for-woocommerce-wordpress-plugin · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/68052614-204f-4237-af0e-4b8210ebd59f?source=cve · Note