{"id":"CVE-2026-96901","aliases":["EUVD-2026-107045","GHSA-x439-gf26-v2wp"],"status":"published","title":"Cart Abandonment Recovery for WooCommerce \u003c 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token","description":"The Cart Abandonment Recovery for WooCommerce  WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00206,"percentile":0.10703,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-10-21T06:00:26Z","modified":"2026-10-21T18:37:38Z","products":[{"vendor":"unknown","product":"cart abandonment recovery for woocommerce"}],"references":[{"url":"https://wpscan.com/vulnerability/f00e95a2-a5fb-49da-aa6c-8c0279b6df2d/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96901"},{"url":"https://wpscan.com/vulnerability/f00e95a2-a5fb-49da-aa6c-8c0279b6df2d"},{"url":"https://github.com/advisories/GHSA-x439-gf26-v2wp"}],"sources":{"cve":[{"id":"CVE-2026-96901","title":"Cart Abandonment Recovery for WooCommerce \u003c 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token","description":"The Cart Abandonment Recovery for WooCommerce  WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.","status":"published","published":"2026-10-21T06:00:26.262Z","modified":"2026-10-21T10:35:00.799Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:20:00.511569Z"}],"euvd":[{"id":"EUVD-2026-107045","description":"The Cart Abandonment Recovery for WooCommerce  WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.","status":"published","published":"2026-10-21T06:00:26Z","modified":"2026-10-21T10:35:00Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:59:40.152045Z"}],"ghsa":[{"id":"GHSA-x439-gf26-v2wp","title":"The Cart Abandonment Recovery for WooCommerce  WordPress plugin before 2.2.0 does not verify the...","description":"The Cart Abandonment Recovery for WooCommerce  WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.","status":"published","published":"2026-10-21T06:31:16Z","modified":"2026-10-21T06:31:23Z","updated_at":"2026-11-02T15:14:09.061875Z"}],"nvd":[{"id":"CVE-2026-96901","description":"The Cart Abandonment Recovery for WooCommerce  WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.","status":"published","published":"2026-10-21T06:16:51.17Z","modified":"2026-10-21T18:37:38.7Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:13:02.045979Z"}]}}