The vulnerability in the Cart Abandonment Recovery for WooCommerce plugin predates version 2.2.0 occurs because the plugin does not verify the integrity of its cart-recovery token before using it. As a result, an unauthenticated attacker who knows the victim's cart session identifier can submit a crafted token that alters the abandoned‑cart record, for example by removing the user from future recovery emails or by applying an arbitrary coupon to the restored cart. The weakness is a classic Authentication Bypass (CWE‑287) that allows an attacker to violate integrity of cart data and user experience.

WordPress sites running the Cart Abandonment Recovery for WooCommerce plugin with a version earlier than 2.2.0 are impacted. The plugin is distributed as a WordPress plugin and is open‑source; there is no vendor name provided. The only version information available is that any release prior to 2.2.0 is vulnerable.

The CVSS estimate of 3.7 marks this issue as low severity, and the EPSS score of less than 1 percent indicates a very low likelihood of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely a remote HTTP request to the plugin’s token endpoint, which does not require authentication or privileged input. Because the attacker only needs the cart session identifier—a value that may be guessable or obtainable from session fingerprints—this risk exists for any site that does not protect those identifiers or prune abandoned carts heavily.