$ cve CVE-2023-2986 JSON

CVE-2023-2986

9.8

CRITICAL · CVSS 3.1 · EPSS 42.5% (pctl 99)

Patch early

EPSS 42.5% — above the 10% action threshold.

Description

The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	42.54% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-288
On CISA KEV	no
Public exploit	none known
Published	2023-06-08
Last modified	2026-06-17

Affected (1)

Vendor	Product
tychesoftwares	abandoned cart lite for woocommerce

References

→ the Explorer · watch your stack · NVD