CVE-2026-96900 — Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification v…

CVE-2026-96900

Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR PUBLISHED

Description (CNA)

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that customer's stored abandoned-cart data.

Affected (CNA)

Vendor / product	Versions
Unknown / Cart Abandonment Recovery for WooCommerce	affected 0 before 2.1.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/67918de2-afc0-468d-8a66-290dc60fe8ec/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.