Abandoned Cart Pro for WooCommerce vulnerabilities
5 known vulnerabilities in Abandoned Cart Pro for WooCommerce from Tyche Softwares. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
Abandoned Cart Pro for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparati
- 9.8 Critical severity
Abandoned Cart Pro for WooCommerce: Authorization Bypass Through User-Controlled Key
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recover
- 7.5 High severity
Abandoned Cart Pro for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient prep
- 8.8 High severity
Abandoned Cart Pro for WooCommerce: Improper Privilege Management
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connect
- 8.8 High severity
Abandoned Cart Pro for WooCommerce: Unrestricted Upload of File with Dangerous Type
The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it poss