Tyche Softwares Abandoned Cart Pro: Critical SQL Injection Lets Attackers Hijack Admin Accounts

Tyche Softwares Abandoned Cart Pro for WordPress contains a critical SQL injection flaw in versions up to 10.8.0. Attackers can exploit this issue to escalate privileges and take full control of the site.

What happened

The National Vulnerability Database records CVE-2026-97668 as a critical vulnerability in the Abandoned Cart Pro plugin. The flaw exists in all versions up to and including 10.8.0. It stems from insufficient escaping of user-supplied data within the `update_guest_persistent_cart()` function. The plugin fails to prepare the existing SQL query properly for this specific operation.

Attacker-controlled checkout fields, such as the SMS consent checkbox, populate the `abandoned_cart_info` value. This data passes through `stripslashes()` before being concatenated directly into an UPDATE statement. While adjacent SELECT and INSERT queries use prepared statements, this specific UPDATE query remains vulnerable. An unauthenticated attacker can append additional SQL commands to the query string.

Because the injection targets an UPDATE statement on the `wp_usermeta` table, the impact is severe. Attackers can extract sensitive information from the database using time-based blind techniques. They can also modify usermeta rows to alter account permissions. Demonstrations show that attackers can escalate an arbitrary account to administrator status. This is achieved by writing a `wp_capabilities` row that shadows the legitimate one.

Why it matters

The vulnerability allows unauthenticated access, meaning attackers do not need valid login credentials to exploit the flaw. The ability to write directly to the `wp_usermeta` table bypasses standard application logic checks. This direct database manipulation enables privilege escalation without triggering typical application-level security warnings.

A CVSS score of 9.8 indicates a high likelihood of successful exploitation with significant impact. The lack of a confirmed fix leaves sites running versions up to 10.8.0 exposed to immediate risk. That suggests organizations must prioritize identifying and isolating affected installations while waiting for vendor action.

What to watch

• Monitor the Tyche Softwares website for a new plugin release addressing CVE-2026-97668.
• Watch for unusual activity in the `wp_usermeta` table, particularly changes to capability rows.
• Check server logs for suspicious SQL-like payloads in checkout form submissions.
• Observe for new administrator accounts created without corresponding user registration events.

Who needs to act first

Teams should prioritize websites that handle high volumes of guest checkout transactions, as these face the highest exposure to unauthenticated attacks. Identify all instances of the Abandoned Cart Pro plugin across the organization’s portfolio. Verify whether any sites are running version 10.8.0 or earlier. Create a complete backup of the database and file system before attempting any manual mitigations. If a patch is unavailable, consider temporarily disabling the plugin or restricting checkout access to authenticated users only. Test any changes in a staging environment first to avoid disrupting legitimate commerce operations. Document all actions taken for audit and compliance purposes.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Abandoned Cart Pro

• Audit all WordPress installations to locate versions of Abandoned Cart Pro up to 10.8.0.
• Review server logs for signs of SQL injection attempts in checkout-related endpoints.
• Restrict access to checkout forms to authenticated users if a fix is not yet available.
• Prepare to apply the vendor’s update immediately upon its release.

Step-by-step guide: Spot Privilege Escalation Warning Signs Before Breach

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Abandoned Cart Pro are affected by this vulnerability?

All versions up to and including 10.8.0 are vulnerable to the SQL injection flaw.

Is there a patch available for CVE-2026-97668?

No, the source material does not indicate that a fix or updated version has been released.

How do attackers exploit this vulnerability?

Attackers inject malicious SQL via checkout fields like the SMS consent option, manipulating the database directly.