The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 24.4.0 because it unserializes untrusted input from the raccookie_guest_email cookie. An unauthenticated attacker can inject a PHP object, but the vulnerability alone does not provide a direct attack vector; it requires a second‑party plugin or theme that contains a PHP Object Poisoning (POP) chain to succeed. If such a chain is present, the attacker could delete arbitrary files, retrieve sensitive data, or execute code, thereby compromising confidentiality, integrity, and potentially availability of the WordPress site.

The affected product is the WooCommerce Recover Abandoned Cart plugin distributed by FantasticPlugins. All releases up to and including version 24.4.0 are vulnerable. The plugin runs on WordPress installations where it is installed and activated.

The CVSS score of 8.1 reflects a high severity with medium to high exploitable impact when a POP chain exists. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to craft a malicious raccookie_guest_email cookie and induce its use, typically by directing a visitor’s browser to the site or forging requests. Exploitation is limited to sites that harbor additional vulnerable code; for sites without such code the risk remains theoretical.