WooCommerce Abandoned Cart Pro Plugin Authentication Bypass Vulnerability

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to an authentication bypass via malleable encryption and bypassable HMAC in all versions up to and including 10.8.0.

The plugin uses MAC-free AES-CTR encryption for cart-recovery link tokens. The 8-byte CTR nonce is carried inside the ciphertext blob, and the encryption key is looked up using the attacker-supplied user_email GET parameter. The HMAC nonce check in wcap_email_track_links() is only enforced when the wcap_nonce parameter is non-empty, allowing complete bypass by omission. An insecure direct object reference on the decrypted abandoned_id has no ownership verification.

• Affected versions: all versions up to and including 10.8.0
• Attack requires: a single legitimate cart-recovery link from the attacker's own reminder email
• Impact: unauthenticated attackers can forge ciphertext for any victim's cart ID and trigger wp_set_auth_cookie(), achieving full account takeover of any user who has abandoned a cart, including administrators
• The auto-login feature defaults to enabled and is forced on during plugin upgrades, so all affected installations are exploitable without additional configuration