A critical authentication flaw in the Abandoned Cart Lite for WooCommerce plugin allows unauthenticated attackers to compromise the security of the WordPress installation.

This plugin is susceptible to improper authentication (CWE-287). The vulnerability allows an unauthenticated attacker to interact with the plugin in a way that bypasses standard authentication checks, potentially leading to unauthorized access to plugin-related data.

The CVSS score of 8.1 reflects a high-severity risk. Successful exploitation could lead to the full compromise of the WooCommerce abandoned cart data, potentially exposing customer PII or allowing an attacker to manipulate site functionality. Such an incident could result in significant reputational damage and regulatory non-compliance.

Immediate Action: Update the Abandoned Cart Lite for WooCommerce plugin to version 6.8.2 or higher immediately.

Proactive Monitoring: Review WordPress logs for suspicious authentication attempts or unexpected plugin behavior that may indicate an attempt to exploit this vulnerability.

Compensating Controls: If an immediate update is not possible, disable the plugin until a patch can be applied, or implement WAF rules to filter malicious traffic targeting the plugin's specific endpoints.

Public Exploit Available: No (Exploit data is unknown).

Given the prevalence of WooCommerce plugins in e-commerce, this vulnerability poses a substantial risk to online stores. Site administrators must ensure the plugin is updated to the latest version immediately and review their security configuration to ensure no unauthorized access has already occurred.