The Recover WooCommerce Cart Abandonment plugin is vulnerable because its install_or_activate_addon_plugins() function lacks a capability check and uses a weak nonce hash in all releases up to 3.5.3. This missing authorization allows any unauthenticated user to trigger the endpoint and install arbitrary WordPress plugins. By doing so, an attacker can place malicious code and potentially execute remote code on the site. The flaw corresponds to CWE‑862, a missing authorization weakness.

This issue affects the FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin on WordPress, versions 3.5.3 and all previous releases. The vulnerability exists in the plugin’s API components, as referenced in the WordPress Trac repository links provided. No other versions or plugins have been explicitly listed as affected.

The CVSS score of 9.8 classifies the vulnerability as critical, and the EPSS score of 20% indicates a high likelihood of exploitation. The plugin is accessible over the network without authentication, so the likely attack vector is via unauthenticated HTTP requests to the plugin’s REST API endpoint. Because an attacker can install any plugin remotely, the risk extends to code execution, data theft, or further compromise of the WordPress installation. The vulnerability is currently not listed in the CISA KEV catalog.