CVE-2023-2986

The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.

• CWE-288

• https://github.com/Ayantaker/CVE-2023-2986
• https://github.com/TycheSoftwares/woocommerce-abandoned-cart/pull/885#issuecomment-1601813615
• https://plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php#L1815Patch
• https://plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php?rev=2916178#L1800Patch
• https://plugins.trac.wordpress.org/changeset/2922242/Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925274%40woocommerce-abandoned-cart&new=2925274%40woocommerce-abandoned-cart&sfp_email=&sfph_mail=
• https://www.wordfence.com/blog/2023/06/tyche-softwares-addresses-authentication-bypass-vulnerability-in-abandoned-cart-lite-for-woocommerce-wordpress-plugin/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/68052614-204f-4237-af0e-4b8210ebd59f?source=cveThird Party Advisory
• https://github.com/Ayantaker/CVE-2023-2986
• https://github.com/TycheSoftwares/woocommerce-abandoned-cart/pull/885#issuecomment-1601813615
• https://plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php#L1815Patch
• https://plugins.trac.wordpress.org/browser/woocommerce-abandoned-cart/trunk/woocommerce-ac.php?rev=2916178#L1800Patch
• https://plugins.trac.wordpress.org/changeset/2922242/Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925274%40woocommerce-abandoned-cart&new=2925274%40woocommerce-abandoned-cart&sfp_email=&sfph_mail=
• https://www.wordfence.com/blog/2023/06/tyche-softwares-addresses-authentication-bypass-vulnerability-in-abandoned-cart-lite-for-woocommerce-wordpress-plugin/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/68052614-204f-4237-af0e-4b8210ebd59f?source=cveThird Party Advisory

Published

Jun 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2985A use after free flaw was found in hfsplus_put_super in fs/h…5.5
• CVE-2023-29850SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does…7.5
• CVE-2023-29854DirCMS 6.0.0 has a Cross Site Scripting (XSS) vulnerability …6.1
• CVE-2023-29855WBCE CMS 1.5.3 has a command execution vulnerability via adm…7.2
• CVE-2023-29856D-Link DIR-868L Hardware version A1, firmware version 1.12 i…9.8
• CVE-2023-29857An issue in Teslamate v1.27.1 allows attackers to obtain sen…5.3
• CVE-2023-29860An insecure permissions in /Taier/API/tenant/listTenant inte…7.5
• CVE-2023-29861An issue found in FLIR-DVTEL version not specified allows a …9.8
• CVE-2023-29862An issue found in Agasio-Camera device version not specified…9.8
• CVE-2023-29863Medical Systems Co. Medisys Weblab Products v19.4.03 was dis…9.8
• CVE-2023-29867Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access…6.5
• CVE-2023-29868Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Acc…6.5