The vulnerability is a Cross‑Site Request Forgery that allows any website to cause a logged‑in user to perform actions through the Abandoned Cart Lite plugin. Because the plugin accepts GET requests without token verification, an attacker can trigger execution of plugin functions such as adding emails or manipulating cart data. This could allow data modification or unintended email notifications, compromising the confidentiality and integrity of the site.

TycheSoftwares' Abandoned Cart Lite for WooCommerce plugin, WordPress sites running any version of the plugin up to and including 6.8.0.

The CVSS base score of 4.3 places this in the moderate risk range. EPSS not available and the issue is not listed in KEV, indicating that there is no verified exploitation yet. Because the flaw is unauthenticated and only requires the victim to visit a crafted URL, the attack vector is relatively easy. Attackers can create a malicious link and lure a logged‑in user to click it, or embed it in a phishing page. Exploitation complexity is low; once the target user performs the request, the privileged action is executed.