medium5.3
CVE-2026-96900
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart rec…
Impact
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that customer's stored abandoned-cart data.
Affected products
| Product | Affected versions |
|---|---|
| Cart Abandonment Recovery For WooCommerce WordPress Plugin | before 2.1.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.