CVE-2023-2986

The record

The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.

Affected packages

Related vulnerabilities

• CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper… CWE-288
• CVE-2026-96387 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop… CWE-288
• CVE-2026-96385 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST &… CWE-288
• CVE-2026-84923 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email… CWE-288
• CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in… CWE-288
• CVE-2026-81906 Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an… CWE-288
• CVE-2026-81787 Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. CWE-288
• CVE-2026-81783 Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions. CWE-288