UNKNOWN NVD

CVE-2026-96901

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and st

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.

References

https://wpscan.com/vulnerability/f00e95a2-a5fb-49da-aa6c-8c0279b6df2d/

Published: 2026-10-21 · Source: NVD · Feed updated: 2026-10-21

This unknown severity vulnerability was published on 2026-10-21 via NVD.

vulnfeed aggregates 17594 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.