https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 20:55:34 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-96901 <p>The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim&#39;s cart session identifier to modify that victim&#39;s abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.</p> <p>The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim&#39;s cart session identifier to modify that victim&#39;s abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.</p> https://db.gcve.eu/vuln/fkie_cve-2026-96901 https://db.gcve.eu/vuln/ghsa-x439-gf26-v2wp <p>The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim&#39;s cart session identifier to modify that victim&#39;s abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.</p> <p>The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim&#39;s cart session identifier to modify that victim&#39;s abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.</p> https://db.gcve.eu/vuln/ghsa-x439-gf26-v2wp