CVE-2026-39470: WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerability

Synopsis

A privilege escalation vulnerability exists in the WooCommerce Cart Abandonment Recovery plugin by Brainstorm Force, affecting all versions before 2.1.0. The flaw is reachable over the network but requires an authenticated session with shop manager-level (admin/privileged) credentials, meaning an attacker must already hold a shop manager account to exploit it. Successful exploitation allows the attacker to escalate their privileges beyond the shop manager role, gaining the ability to read, modify, or disrupt any data the elevated account can access. A patched-image rebuild at version 2.1.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress or WooCommerce HTTP endpoint over the network to deliver the exploit request.

• AuthenticationRequired

  A shop manager account (an admin or privileged role within WooCommerce) is required before the escalation can be triggered.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker acts entirely on their own once authenticated.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout, or other variable environmental factors.

Blast Radius

• Attacker reads any data accessible to the escalated privilege level, including order records, customer PII, and stored payment metadata.
• Attacker modifies site configuration, product listings, pricing, or order data with the elevated account's write permissions.
• Attacker can disrupt site availability or disable plugin functionality by altering settings that the escalated role controls.
• Full confidentiality, integrity, and availability impact is possible once privilege escalation succeeds, given CVSS C:H/I:H/A:H scoring.