Abandoned Cart Lite for WooCommerce Authentication Bypass Vulnerability

A vulnerability in the Abandoned Cart Lite for WooCommerce WordPress plugin, affecting versions prior to 6.8.2, allows unauthenticated attackers to forge recovery links that log them in as other users. This issue arises because the plugin does not properly secure its cart-recovery tokens or associate them with the user's account. When the automatic-login feature is activated, the forged links can be used to gain unauthorized access.

Impact

Exploitation of this vulnerability could lead to unauthorized account access, allowing attackers to log in as other users.

Remediation

Users are advised to update the Abandoned Cart Lite for WooCommerce WordPress plugin to version 6.8.2 or later.