CVE-2026-96901 Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-96901?
CVE-2026-96901 is a low-severity vulnerability in Unknown Cart Abandonment Recovery for WooCommerce, published on 21 Oct 2026.
Official description
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.
Weakness: CWE-287
Which versions are affected by CVE-2026-96901?
How do I fix CVE-2026-96901?
No fix has been published for CVE-2026-96901 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-96901 being exploited?
There is no known exploitation of CVE-2026-96901 in the wild and no public exploit code.
Sources
Also known as GHSA-x439-gf26-v2wp.