CVE-2026-96901

The Cart Abandonment Recovery for WooCommerce WordPress plugin (versions before 2.2.0 ) contains a vulnerability where it fails to verify the integrity of its cart-recovery token . The plugin still accepts an unsigned legacy token format , which allows unauthenticated attackers who possess a vict...

CVE-2026-96901 Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that...