CVE-2026-81543
validatedZero produced an exploit or a check.GHSA-9cx9-pmgp-c6x4 ↗EUVD-2026-71935 ↗
description
Abandoned Cart Pro for WooCommerce through version 10.7.1 has authorization flaws in administrative AJAX functionality. A logged-in low-privilege user may obtain administrator access when the auto-login feature is enabled, which is the default setting.
mitigation
Disable the plugin's auto-login feature immediately and remove or restrict untrusted low-privilege accounts. Until the vendor publishes a fixed release, disable the plugin where possible and review SMTP connector settings and administrator sessions for unauthorized changes.
outcome
Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-09-05 07:38Zcve.org record for CVE-2026-81543
- 2026-10-26vulncheck_kev: trigger signal, started the run
- 2026-10-26 00:00Z
- 2026-10-26 18:26Z
this entry in the feed
GET /api/v1/feed/CVE-2026-81543
{ "etk_id": "ETK-2026-2677", "cve_id": "CVE-2026-81543", "display_id": "CVE-2026-81543", "ghsa_id": "GHSA-9cx9-pmgp-c6x4", "euvd_id": "EUVD-2026-71935", "status": "published", "anchor_state": "anchored", "title": "Privilege escalation in Abandoned Cart Pro for WooCommerce", "summary": "Abandoned Cart Pro for WooCommerce through version 10.7.1 has authorization flaws in administrative AJAX functionality. A logged-in low-privilege user may obtain administrator access when the auto-login feature is enabled, which is the default setting.", "mitigation": "Disable the plugin's auto-login feature immediately and remove or restrict untrusted low-privilege accounts. Until the vendor publishes a fixed release, disable the plugin where possible and review SMTP connector settings and administrator sessions for unauthorized changes.", "vendor": "Tyche Softwares", "product": "Abandoned Cart Pro for WooCommerce", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 10.7.1" ], "ecosystem": null, "fixed_versions": [], "package_name": "Abandoned Cart Pro for WooCommerce", "purl": null } ], "cwes": null, "cvss_score": 8.8, "cvss_src": "other", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "upstream", "exploit": false, "pipeline_minutes": 0.0099955, "t0_at": "2026-09-05T07:38:15.360000+00:00", "signals": { "check": { "at": "2026-10-26T18:26:58.930210+00:00", "days": 51.45050428483796, "is_lower_bound": false, "measured_at": "2026-09-05T07:38:15.360000+00:00", "url": null }, "kev": { "at": "2026-10-26T00:00:00+00:00", "days": 51, "is_lower_bound": false, "measured_at": "2026-09-05T07:38:15.360000+00:00", "precision": "day", "url": "https://vulncheck.com/cve/CVE-2026-81543" }, "trigger_signal": { "at": "2026-10-26T00:00:00+00:00", "days": 50.68176666666667, "is_lower_bound": false, "measured_at": "2026-09-05T07:38:15.360000+00:00", "url": "https://vulncheck.com/cve/CVE-2026-81543" } } }
published 2026-10-26 18:26Z
last change 2026-10-26 21:51Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.