The Abandoned Cart Pro for WooCommerce plugin permits unauthenticated attackers to inject SQL through the "validate" parameter. Insufficient escaping and the absence of prepared statements allow an attacker to append arbitrary SQL clauses. Because AES‑CTR is a malleable stream cipher, a legitimate token can be modified to carry forged ciphertext that contains malicious SQL code, and the plugin’s HMAC check is bypassed when the optional "wcap_nonce" parameter is omitted.

Tyche Softwares’ Abandoned Cart Pro for WooCommerce is affected in all releases up to and including version 10.8.0. Any WordPress site running any of those versions is vulnerable.

The CVSS score of 7.5 indicates the vulnerability poses a moderate to high risk. The EPSS score of less than 1% suggests that the edge probability of exploitation is low, yet the vulnerability is still feasible without authentication or special privileges. The vulnerability is not listed in the CISA KEV catalog, but the lack of authentication and the possibility to recover and forge the keystream make it attractive for attackers who can control an email address to obtain a valid token.