CVE-2023-2986 in the critical feed json
Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass
published 2023-06-08 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-34422
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 42.5%
- EPSS 42.5% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.
Patch / fix
- plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.ph… patch
- plugins.trac.wordpress.org/changeset/2922242/ patch
- plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.ph… patch
- github.com/TycheSoftwares/woocommerce-abandoned-cart#885 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 22 mo ago
Exploit prediction
42.54% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- tychesoftwares Abandoned Cart Lite for WooCommerce
Classification
- Weakness
-
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
- Technology feeds
References
- github.com /TycheSoftwares/woocommerce-abandoned-cart/pull/885#issuecomment-1601813615
-
plugins.trac.wordpress.org
/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php#L1815
patch
-
plugins.trac.wordpress.org
/changeset/2922242/
patch
-
plugins.trac.wordpress.org
/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php?rev=2916178#L1800
patch
-
wordfence.com
/threat-intel/vulnerabilities/id/68052614-204f-4237-af0e-4b8210ebd59f?source=cve
third-party-advisory
- plugins.trac.wordpress.org /changeset?sfp_email=&sfph_mail=&reponame=&old=2925274%40woocommerce-abandoned-cart&new=2925274%40woocommerce-
- wordfence.com /blog/2023/06/tyche-softwares-addresses-authentication-bypass-vulnerability-in-abandoned-cart-lite-for-woocomm
- github.com /Ayantaker/CVE-2023-2986
Sources
- CVE List CVE-2023-2986
- NVD CVE-2023-2986
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.