On May 29, 2023, the WordFence Threat Intelligence team identified and began the responsible disclosure process for an Authentication Bypass vulnerability in Tyche Softwares’s Abandoned Cart Lite for WooCommerce plugin, which is actively installed on more than 30,000 WordPress websites. This vulnerability makes it possible for an attacker to gain access to the accounts of users who have abandoned their carts, who are typically customers but can extend to other high-level users when the right conditions are met.
Users of paid WordFence versions received a firewall rule to protect against any exploits targeting this vulnerability on June 7, 2023. Sites still using the free version of Wordfence will receive the same protection on July 7, 2023.
WordFence contacted Tyche Softwares on May 30, 2023, and received a response the next day. After providing full disclosure details, the developer released a patch on June 6, 2023. We would like to commend the Tyche Softwares development team for their prompt response and timely patch.
We urge users to update their sites with the latest patched version of Abandoned Cart Lite for WooCommerce, version 5.15.1 at the time of this writing, as soon as possible.
Source and more details: https://www.wordfence.com/blog/2023/06/tyche-softwares-addresses-authentication-bypass-vulnerability-in-abandoned-cart-lite-for-woocommerce-wordpress-plugin