This vulnerability stems from insufficient escaping of user‑supplied data in the guest cart persistent meta_value field of the plugin. The arbitrary value, obtained from publicly accessible checkout fields such as the SMS consent box, is concatenated directly into an UPDATE statement, creating a classic SQL injection (CWE‑89). An attacker can exploit this to read sensitive data from the wp_usermeta table or to overwrite rows, including the wp_capabilities field. By injecting a value that writes a valid admin capability, an unauthenticated user can elevate a regular account to administrator, granting full control over the site and potential data exfiltration.

All installations of the Abandoned Cart Pro for WooCommerce plugin by Tyche Softwares, specifically releases up to and including version 10.8.0. No other products or later versions are listed as vulnerable.

The CVSS score of 9.8 marks this flaw as critical, while the EPSS score of less than 1% shows a low but nonzero probability of exploitation. The vulnerability is reachable via the public guest checkout page, requiring no authentication. An attacker can append crafted SQL fragments to the update_guest_persistent_cart() call, enabling time‑based blind extraction or direct modification of usermeta rows. If successfully exploited, the attacker obtains administrator rights and can compromise the entire WordPress site.