CVE-2026-97657

Executive Summary

CVE-2026-97657 is a critical authentication bypass vulnerability in the Abandoned Cart Pro for WooCommerce WordPress plugin, affecting all versions up to and including 10.8.0. The flaw combines MAC-free AES-CTR encryption, a bypassable HMAC check, and an insecure direct object reference (IDOR) on the decrypted cart identifier, allowing unauthenticated attackers to forge cart-recovery tokens and trigger wp_set_auth_cookie() for arbitrary victims. Successful exploitation results in complete account takeover, including administrative accounts, on any site where a user has ever abandoned a cart — and the vulnerable auto-login feature is enabled by default and forced on during upgrades.

Technical Analysis

The vulnerability arises from a chain of cryptographic and authorization design failures in the plugin's cart-recovery link mechanism.

1. MAC-free AES-CTR encryption: Cart-recovery link tokens are encrypted with AES in Counter (CTR) mode without a Message Authentication Code. In CTR mode, encryption is a stream cipher: ciphertext = plaintext XOR keystream. If an attacker knows or can guess any plaintext segment and possesses the corresponding ciphertext, they can recover the keystream segment. Because the 8-byte CTR nonce is carried inside the ciphertext blob itself, the attacker can reuse the same keystream for forged ciphertexts.

2. Attacker-controlled key selection: The encryption key is looked up using the attacker-supplied user_email GET parameter. This means the attacker selects which user's key is used to encrypt/decrypt a token, removing the binding between the token and the legitimate recipient.

3. Bypassable HMAC nonce check: The function wcap_email_track_links() performs an HMAC nonce check, but only when the wcap_nonce parameter is non-empty. Supplying an empty or omitted wcap_nonce parameter causes the check to be skipped entirely — a complete bypass by omission.

4. IDOR on decrypted abandoned_id: After decryption, the plugin uses the abandoned_id without verifying that the cart belongs to the email used for decryption. Thus, an attacker who forges a ciphertext that decrypts to a victim's cart ID can proceed even though the key was derived from a different email.

The combination allows an unauthenticated attacker who possesses a single legitimate cart-recovery link — obtained from their own reminder email — to recover keystream material, construct a forged ciphertext for any victim's cart ID, and trigger wp_set_auth_cookie() for that victim, achieving full account takeover.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / Target Identification The attacker identifies a WordPress site running the vulnerable Abandoned Cart Pro for WooCommerce plugin (versions ≤ 10.8.0). The plugin is detectable via public HTTP responses (e.g., plugin paths) and Shodan dorks such as http.html:"wp-content/plugins/woocommerce-abandoned-cart". The attacker needs at least one valid cart-recovery link sent to an email address they control. Sites with abandoned carts — common on e-commerce installations — are prime targets.

2. Triggering the Flaw Using their own legitimate cart-recovery link, the attacker obtains a ciphertext blob and knows the corresponding plaintext structure (cart ID, email). Because AES-CTR is a stream cipher and the nonce is embedded in the ciphertext, the attacker recovers the keystream segment by XORing known plaintext with ciphertext. They then select a victim's cart ID (e.g., an administrator who has abandoned a cart) and construct a forged ciphertext that, when decrypted with the key looked up via the attacker-supplied user_email parameter, yields the victim's cart ID. The wcap_nonce parameter is omitted to bypass the HMAC check in wcap_email_track_links().

3. Payload / Execution The attacker sends a crafted HTTP request to the vulnerable endpoint, supplying the forged ciphertext and an empty or absent wcap_nonce. The user_email parameter is set to the attacker's email to control key selection. The plugin decrypts the forged token, skips the HMAC check, and uses the decrypted abandoned_id (the victim's cart ID) without ownership verification. This triggers a call to wp_set_auth_cookie() for the victim user.

4. Post-Exploitation Impact The attacker receives a valid authentication cookie for the victim account. Because any user who has ever abandoned a cart is vulnerable — including administrators — the attacker can achieve full account takeover of privileged accounts. This enables complete site compromise: installing malicious plugins, modifying content, exfiltrating customer data, and pivoting to other systems. The auto-login feature is enabled by default and forced on during upgrades, so no additional configuration is required for exploitation.

Impact Assessment

CVSS 3.1 base score: 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

• Confidentiality (High): Full access to victim accounts, including administrative accounts, exposes sensitive data such as customer records, order history, and site configuration.
• Integrity (High): Attackers can modify site content, install plugins, alter user roles, and plant backdoors.
• Availability (High): With administrative access, attackers can deface, disable, or destroy the site and its data.
• Scope (Unchanged): The vulnerable component (WordPress plugin) and impacted component (WordPress site) are the same security authority.
• Blast radius: Every WordPress installation running Abandoned Cart Pro for WooCommerce ≤ 10.8.0 with at least one abandoned cart (virtually all active e-commerce sites) is at risk. The default-enabled auto-login feature means no opt-in is required. This is a wormable, unauthenticated, pre-auth remote compromise.

Detection Guidance

Sigma Rule

title: Abandoned Cart Pro for WooCommerce Authentication Bypass Attempt
id: 7f8a9b0c-1d2e-3f4a-5b6c-7d8e9f0a1b2c
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2026-97657 via missing wcap_nonce parameter combined with user_email manipulation.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method: 'GET'
  selection_uri:
    cs-uri-query|contains: 'wcap_'
  selection_nonce_absent:
    cs-uri-query|contains: 'user_email='
  filter_legit:
    cs-uri-query|contains: 'wcap_nonce='
  condition: selection_method and selection_uri and selection_nonce_absent and not filter_legit
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate plugin requests missing optional parameters
level: high

YARA Rule

rule CVE_2026_97657_AbandonedCart_AuthBypass
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-97657 in Abandoned Cart Pro for WooCommerce"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97657"
        severity = "critical"

    strings:
        $param1 = "wcap_nonce"
        $param2 = "user_email"
        $func1  = "wcap_email_track_links"
        $func2  = "wp_set_auth_cookie"
        $func3  = "abandoned_id"
        $aes    = "aes-256-ctr" nocase
        $aes2   = "AES-CTR" nocase

    condition:
        uint16(0) == 0x3C3F or uint16(0) == 0x2F2A or
        (2 of ($param*) and 1 of ($func*)) or
        (any of ($func*) and any of ($aes*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97657 Abandoned Cart Pro WooCommerce Authentication Bypass Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"wcap_"; http.uri; content:"user_email"; http.uri; pcre:"/wcap_nonce=($|&)/i"; reference:cve,2026-97657; classtype:attempted-admin; sid:202697657; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where http.request.method == "GET" and http.request.query contains "wcap_" and http.request.query contains "user_email"]
  [network where http.request.query not contains "wcap_nonce="]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_query="*wcap_*" uri_query="*user_email=*"
| where NOT match(uri_query, "wcap_nonce=[^&]+")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as queries by clientip, uri_path
| where count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,woocommerce,">
  <rule id="100976" level="12">
    <if_sid>31100</if_sid>
    <field name="url">wcap_</field>
    <field name="url">user_email</field>
    <description>CVE-2026-97657: Abandoned Cart Pro for WooCommerce authentication bypass attempt detected (missing wcap_nonce).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_97657,authentication_bypass,</group>
  </rule>
  <rule id="100977" level="14">
    <if_sid>100976</if_sid>
    <field name="url">user_email=admin</field>
    <description>CVE-2026-97657: Possible administrative account takeover attempt via Abandoned Cart Pro.</description>
    <group>cve_2026_97657,account_takeover,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations

• Disable the auto-login feature in the Abandoned Cart Pro for WooCommerce plugin settings if an option exists, or deactivate the plugin entirely until a patch is available.
• Restrict access to cart-recovery endpoints using a Web Application Firewall (WAF) rule that rejects requests containing user_email with an empty or missing wcap_nonce parameter.
• Audit user accounts for unauthorized sessions and enforce password resets for accounts that may have been compromised.
• Monitor web server logs for the detection signatures provided in this report.

2. Patch / Upgrade Steps

• No vendor patch is currently available. Monitor the plugin vendor's official channels for a security update.
• When a patch is released, upgrade immediately to the fixed version. Verify the patch includes authentication of the CTR nonce, mandatory HMAC enforcement, and ownership verification on the decrypted abandoned_id.
• If the plugin is abandoned or no patch is forthcoming, consider replacing it with an actively maintained alternative.

3. Long-Term Hardening

• Enforce cryptographic best practices for token generation: use AEAD (e.g., AES-GCM) or encrypt-then-MAC constructions; never use MAC-free CTR mode for authentication tokens.
• Ensure encryption keys are derived from server-side secrets, not user-supplied parameters.
• Implement strict ownership checks (authorization) on all object references, including decrypted identifiers.
• Conduct regular security audits of third-party WordPress plugins and remove unused or unmaintained components.
• Adopt least-privilege principles for WordPress user roles and enable multi-factor authentication for administrative accounts.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97657
• CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• WordPress Plugin Security Best Practices — https://developer.wordpress.org/plugins/security/
• OWASP Top 10: A01:2021 – Broken Access Control — https://owasp.org/Top10/A01_2021-Broken_Access_Control/

No threat actor campaigns or exploit-in-the-wild evidence are available at this time. CISA KEV: NO.