The vulnerability allows a subscriber user of the Abandoned Cart Pro for WooCommerce plugin to increase their privileges beyond the intended scope. This is a privilege management error (CWE-266) that can lead to unauthorized access to sensitive administrative functions within the WordPress site. The impact is the potential to alter, delete, or create content and settings that should be restricted to higher‑privilege roles.

Tyche Softwares’ Abandoned Cart Pro for WooCommerce plugin versions 10.4.0 and earlier are impacted. The plugin is widely used in WordPress stores that rely on WooCommerce for e‑commerce transactions. Users of any affected version should verify their installed version number.

The CVSS score of 8.8 indicates a high severity and shows that the flaw is exploitable by an authenticated subscriber. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the potential for privilege escalation in a widely deployed e‑commerce plugin makes it a compelling target for attackers. Likely attack vectors involve legitimate user actions via the plugin’s UI or crafted HTTP requests that the plugin improperly authorizes. An attacker who has compromised a subscriber account can use the flaw to elevate privileges, leading to broader site compromise.