Abandoned Cart Lite for WooCommerce before 5.8.2 — SQL Injection
Unsanitised cart parameters in Abandoned Cart Lite for WooCommerce exposed stored customer data to unauthenticated extraction. Fixed in 5.8.3.
This page preserves a historical WPDeeply disclosure at its original URL. The research is credited to its author; remediation information has been kept current by the site’s present operators, who did not discover the vulnerability.
Abandoned cart plugins exist to remember what a shopper nearly bought. To do that they store cart contents alongside identifying details — email address, name, sometimes more — and they accept parameters from the visitor’s browser to tie a returning session back to the right record. That is a data-rich table reachable through visitor-supplied input, which is precisely the combination that makes an injection flaw serious rather than academic.
The vulnerability
- Affected: Abandoned Cart Lite for WooCommerce ≤ 5.8.2
- Fixed in: 5.8.3
- Type: Unauthenticated SQL injection
- Privileges required: none
- CVE: none assigned. The issue is recorded in WordPress vulnerability databases, which cite this disclosure.
The plugin took cart-identifying values from the request and used them in database queries without adequate sanitisation or parameter binding. Because the endpoints involved are meant to work for ordinary shoppers, no authentication stood in front of them. An unauthenticated request was enough to alter the meaning of the query.
The interesting part is not the mechanics — an unescaped parameter in a query is an old story — but the location. The affected tables sat next to WooCommerce order and customer data. On a store of any size, that is the most sensitive material on the server after the credentials themselves.
Impact
- Extraction of stored abandoned-cart records, including customer email addresses and names.
- Read access to other data available to the WordPress database user, including the users table and its password hashes.
- A GDPR-relevant personal data breach on any affected store, with the notification obligations that follow.
For a merchant, the regulatory consequence can outlast the technical one. Customer names and email addresses harvested from a store are personal data under the GDPR, and a store operator who discovers a breach carries a documentation and, in many cases, notification duty. That is a materially different situation from a defaced homepage.
When you evaluate an e-commerce plugin, ask what it stores before you ask what it does. A marketing add-on that keeps customer contact details in its own tables inherits the risk profile of the store, not of a marketing widget.
What to do now
- Update to 5.8.3 or later. Current releases are well beyond the affected range.
- If your store ran an affected version while publicly reachable, treat customer data as potentially exposed: review access logs for repeated parameter-manipulation patterns against the plugin’s endpoints, rotate administrator credentials, and document what you found.
- Check whether you still need the plugin at all. Abandoned-cart tables accumulate personal data indefinitely on many installs; deleting stale records reduces what a future flaw can leak.
- Confirm your store is not running other unmaintained WooCommerce extensions — a scan takes a few seconds and covers all of them.
Related reading
- SQL injection in WordPress, explained
- WooCommerce security and vulnerability history
- WooCommerce before 4.1.0 — remote code execution
Research and original disclosure by Slavco Mihajloski (mslavco), published on WPDeeply.