The vulnerability allows an unauthenticated user to forge a cart‑recovery link by exploiting MAC‑free AES‑CTR encryption and a bypassable HMAC check. By taking a legitimate recovery token for one account, the attacker can recover the keystream, create a ciphertext that decrypts to any target user's cart ID, and trigger the plugin's auto‑login function. This results in immediate account takeover of any user who has abandoned a cart, including administrators, with no authentication required.

All WordPress sites that have installed Tyche Softwares' Abandoned Cart Pro for WooCommerce plugin in versions up to and including 10.8.0 are affected. The flaw resides in the cart‑recovery link handling code, which is executed on each site request where the plugin is active.

With a CVSS score of 9.8 this issue is critical, yet the EPSS score of less than 1% indicates that exploitation is currently unlikely, pointing to a low attack frequency. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote and requires only an unauthenticated HTTP GET request to a recovery link; an attacker needs knowledge of a valid cart‑recovery link for any user but does not need credentials for the target. Once forged, the link triggers wp_set_auth_cookie() and logs the victim in automatically.