Update Abandoned Cart Pro Immediately to Block Unauthenticated Admin Escalation via SQL Injection

An unauthenticated visitor can potentially take full administrative control of a WooCommerce site by exploiting a flaw in the Abandoned Cart Pro plugin. This critical vulnerability, tracked as CVE-2026-97668, affects all plugin versions up to and including 10.8.0 and allows attackers to manipulate database records without credentials.

The flaw enables an attacker to append malicious SQL commands to a database update query. By modifying the guest cart persistent meta_value through standard checkout fields, such as the SMS consent option, an adversary can inject code. This injection targets the wp_usermeta table, allowing the extraction of sensitive information via time-based blind techniques or the direct modification of user metadata rows.

Technical Context

The vulnerability stems from insufficient escaping of user-supplied data within the update_guest_persistent_cart() function. While adjacent SELECT and INSERT queries use prepared statements, the specific UPDATE statement concatenates the abandoned_cart_info value directly after passing it through stripslashes(). This inconsistency creates a window for injection. The NVD rates the issue as critical with a CVSS score of 9.8, citing CWE-89 weaknesses.

Impact on Stores

Store owners using Abandoned Cart Pro for WooCommerce up to version 10.8.0 are exposed to unauthorized access. An attacker does not need a user account to exploit this; they simply need to interact with the checkout process. The demonstration showed that an arbitrary account could be escalated to an administrator by writing a wp_capabilities row that shadows the legitimate one, effectively granting full site control.

What to watch

Monitor your site for unexpected changes in user permissions, particularly new administrator accounts created without your knowledge. Review access logs for unusual activity originating from checkout pages. If you rely on the plugin's SMS or guest cart features, assume these fields are potential vectors for injection until a fix is confirmed and applied.

What made it possible

This type of intrusion relies on the failure to properly sanitize input before it interacts with a database. When application code concatenates user-controlled strings directly into SQL queries rather than using parameterized statements, it blurs the line between data and command structure. Attackers exploit this by injecting syntax that alters the query's intent. Teams usually see this at the initial access stage, where a single unchecked form field allows an adversary to read or write sensitive database records, bypassing standard application logic and authentication controls.

What to do and how to stay safe: Abandoned Cart Pro

• Verify if your WooCommerce installation uses Abandoned Cart Pro version 10.8.0 or earlier.
• Monitor database logs for unexpected UPDATE commands on the wp_usermeta table.
• Restrict access to checkout fields that process guest cart information until a patch is available.
• Review user account permissions regularly to detect unauthorized administrator escalations.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Abandoned Cart Pro are vulnerable?

All versions up to and including 10.8.0 are affected by this SQL injection flaw.

Do attackers need a login to exploit this?

No, the vulnerability allows unauthenticated attackers to execute malicious SQL queries.

What can an attacker do with this flaw?

They can extract sensitive data and escalate arbitrary accounts to administrator privileges.