The Cart Abandonment Recovery for WooCommerce plugin for WordPress before version 2.1.4 fails to verify that the user owns the email address used to identify an abandoned‑cart record before performing delete or overwrite operations. This missing authorization check allows an unauthenticated attacker who knows a customer’s email address to delete that customer’s stored abandoned‑cart data or replace it with arbitrary content. The impact is loss or corruption of customer cart data, which affects data integrity and can diminish customer trust but does not provide code execution or direct access to the system.

WordPress sites that have the Cart Abandonment Recovery for WooCommerce plugin installed at a version older than 2.1.4 are affected. The vulnerability targets the plugin’s abandoned‑cart record endpoints that accept an email parameter to identify the cart record. No other WordPress plugins or core components are impacted.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests that exploit attempts are unlikely to be found in the wild, and the lack of an entry in CISA’s KEV catalog confirms no known widespread exploitation. However, the attacker only needs to know a valid customer email and to send a crafted HTTP request to the vulnerable endpoint, implying a low‑threat but still valuable attack vector. The attack is limited to data tampering and does not lead to code execution or privilege escalation.