[CVE-2026-12585] The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity…

Descripción técnica

The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.

Puntuación CVSS

Score: 8.1/10 — Severidad: HIGH — Estado NIST: Deferred

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Debilidades (CWE)

CWE-287

Fuente oficial

Publicado en NIST NVD.