A critical privilege escalation vulnerability in the Abandoned Cart Pro for WooCommerce plugin allows authenticated users to hijack administrative accounts, posing a severe risk of full site compromise.

The plugin suffers from improper privilege management due to missing capability checks and nonce verification on multiple AJAX actions, allowing authenticated attackers with subscriber-level access to manipulate critical plugin settings. By rerouting SMTP traffic and intercepting auto-login links, an attacker can gain full administrative access to the WordPress environment.

Successful exploitation of this vulnerability results in full administrative control over the affected WordPress installation. Given the high CVSS score of 8.8, this represents a significant threat to data integrity, confidentiality, and system availability. Unauthorized access by an attacker could lead to the theft of customer data, the distribution of malicious content, and complete loss of site control, resulting in substantial reputational and financial damage.

Immediate Action: Identify if the Abandoned Cart Pro for WooCommerce plugin is installed and verify if the auto-login feature is enabled. Monitor official vendor channels for the release of a patched version and apply the update immediately upon availability.

Proactive Monitoring: Review WordPress audit logs for suspicious activity involving AJAX requests or unexpected modifications to SMTP and email settings. Monitor for any unauthorized administrative account creation or changes to user permissions.

Compensating Controls: Disable the plugin's auto-login feature if it is currently enabled to neutralize the primary attack vector. Implement a Web Application Firewall (WAF) rule to block unauthorized access to the specified AJAX endpoints (wcap_save_connector_settings, wcap_send_manual_email, etc.) for non-administrative users.

Public Exploit Available: No

The high severity of this vulnerability necessitates an immediate and prioritized response. Organizations utilizing this plugin should treat this as a high-priority security issue, verify their current plugin version, and take the recommended steps to disable vulnerable features while awaiting a formal patch from the vendor. Failure to address this flaw leaves the administrative layer of the website exposed to low-privileged attackers.