Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass
Published Jun 8, 2023
9.8
CRITICALCVSS 3.1
EPSS 42.54%
Description
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.
Affected products
-
- Version 0StatusaffectedConstraints<=5.15.1
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Tychesoftwares | Abandoned Cart Lite for WooCommerce | unaffected |
|
- ≤ 5.14.2
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
TotalDecision
n/aAssessed Dec 26, 2024 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
Score over time
2023–2026- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (29 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 42.54% (0.42544) | 98.67th | v5 (v2026.06.15) |
| Jul 21, 2026 | 42.81% (0.42814) | 98.58th | v5 (v2026.06.15) |
| Jul 5, 2026 | 41.08% (0.41077) | 98.49th | v5 (v2026.06.15) |
| Jun 15, 2026 | 43.50% (0.43502) | 98.57th | v5 (v2026.06.15) |
| Nov 21, 2025 | 91.77% (0.91769) | 99.66th | v4 (v2025.03.14) |
| Nov 18, 2025 | 80.44% (0.80444) | 99.20th | v4 (v2025.03.14) |
| Jun 15, 2025 | 91.55% (0.91547) | 99.64th | v4 (v2025.03.14) |
| Jun 13, 2025 | 80.86% (0.80862) | 99.09th | v4 (v2025.03.14) |
| Mar 30, 2025 | 65.50% (0.65495) | 98.36th | v4 (v2025.03.14) |
| Mar 29, 2025 | 68.18% (0.68178) | 98.08th | v4 (v2025.03.14) |
| Mar 28, 2025 | 65.50% (0.65495) | 98.36th | v4 (v2025.03.14) |
| Mar 27, 2025 | 68.18% (0.68178) | 98.43th | v4 (v2025.03.14) |
| Mar 25, 2025 | 65.50% (0.65495) | 98.38th | v4 (v2025.03.14) |
| Mar 23, 2025 | 70.03% (0.70035) | 98.54th | v4 (v2025.03.14) |
| Mar 20, 2025 | 65.50% (0.65495) | 98.39th | v4 (v2025.03.14) |
| Mar 19, 2025 | 70.03% (0.70035) | 98.54th | v4 (v2025.03.14) |
| Mar 17, 2025 | 65.50% (0.65495) | 98.35th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.40% (0.00400) | 74.43th | v3 (v2023.03.01) |
| Jul 10, 2024 | 0.29% (0.00295) | 69.50th | v3 (v2023.03.01) |
| Jun 14, 2024 | 0.25% (0.00249) | 65.03th | v3 (v2023.03.01) |
| May 8, 2024 | 0.34% (0.00336) | 71.15th | v3 (v2023.03.01) |
| Feb 8, 2024 | 0.36% (0.00364) | 71.57th | v3 (v2023.03.01) |
| Nov 28, 2023 | 0.36% (0.00364) | 69.31th | v3 (v2023.03.01) |
| Oct 17, 2023 | 0.26% (0.00256) | 63.14th | v3 (v2023.03.01) |
| Jul 8, 2023 | 0.24% (0.00239) | 60.88th | v3 (v2023.03.01) |
| Jun 24, 2023 | 0.12% (0.00122) | 45.52th | v3 (v2023.03.01) |
| Jun 20, 2023 | 0.10% (0.00103) | 40.94th | v3 (v2023.03.01) |
| Jun 15, 2023 | 0.06% (0.00063) | 25.19th | v3 (v2023.03.01) |
| Jun 8, 2023 | 0.04% (0.00045) | 12.56th | v3 (v2023.03.01) |
References (8)
- https://github.com/Ayantaker/CVE-2023-2986
- https://github.com/TycheSoftwares/woocommerce-abandoned-cart/pull/885#issuecomment-1601813615
- https://plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php#L1815 Patch
- https://plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php?rev=2916178#L1800 Patch
- https://plugins.trac.wordpress.org/changeset/2922242/ Patch
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925274%40woocommerce-abandoned-cart&new=2925274%40woocommerce-abandoned-cart&sfp_email=&sfph_mail=
- https://www.wordfence.com/blog/2023/06/tyche-softwares-addresses-authentication-bypass-vulnerability-in-abandoned-cart-lite-for-woocommerce-wordpress-plugin/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/68052614-204f-4237-af0e-4b8210ebd59f?source=cve Third Party Advisory
Change history (0)
No recorded changes yet.