CVE-2023-2986 Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass
Unauthenticated attackers can bypass authentication and log in as customers by exploiting insufficient encryption in abandoned cart links.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-2986?
CVE-2023-2986 is a critical authentication bypass vulnerability in tychesoftwares Abandoned Cart Lite for WooCommerce, published on 8 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.
Weakness: CWE-288
Which versions are affected by CVE-2023-2986?
It affects 1 product.
Products include Tychesoftwares Abandoned Cart Lite for Woocommerce.
How do I fix CVE-2023-2986?
No fix has been published for CVE-2023-2986 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-2986 being exploited?
There is no known exploitation of CVE-2023-2986 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in tychesoftwares Abandoned Cart Lite for WooCommerce
Sources
Also known as GHSA-54x7-q6m6-mjqv.