WooCommerce Abandoned Cart Pro Plugin SQL Injection Vulnerability

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 10.8.0. The flaw exists in the update_guest_persistent_cart() function, where the abandoned_cart_info value is insufficiently escaped and concatenated into an UPDATE statement.

This value is populated from attacker-controlled checkout fields such as the SMS consent field, passed through stripslashes(), and added directly to the SQL query while adjacent SELECT and INSERT statements use prepared statements. As a result, unauthenticated attackers can append additional SQL to the query.

• Affected versions: all versions up to and including 10.8.0
• Attack vector: unauthenticated, via guest cart persistent meta_value and checkout fields
• Impact: time-based blind extraction of sensitive database information and modification of wp_usermeta rows
• Demonstrated exploit: escalation of an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one