WordPress plugin · woo-cart-abandonment-recovery

Is Cart Abandonment Recovery for WooCommerce safe?

Safe on 2.2.2 or newer.

The current version, 2.2.2, is past every affected range on record (3 of 4 records list one; 1 doesn’t, so check it below). Keep it updated and you’re clear of them.

Flaws on record: 4
High or critical: 1
Exploited: none
Current version: 2.2.2
Last updated: Oct 26, 2026
Active installs: 300,000+

Every recorded flaw

Oct 21, 2026Cart Abandonment Recovery for WooCommerce: Does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token formatCVE-2026-96901 · fixed in 2.2.0 · reported by WPScanLow 3.7
Oct 14, 2026Cart Abandonment Recovery for WooCommerce: Does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting itCVE-2026-96900 · fixed in 2.1.4 · reported by WPScanMedium 5.3
Jun 15, 2026Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.CVE-2026-39470 · reported by PatchstackHigh 7.2
Apr 3, 2024WooCommerce Cart Abandonment Recovery: Does not have CSRF check in its bulk actionsCVE-2024-2322 · fixed in 1.2.27 · reported by WPScanMedium 6.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Is Cart Abandonment Recovery for WooCommerce safe?

Safe on 2.2.2 or newer.

Every recorded flaw

The flaws that hit local websites, every Friday.

Tell us what you're building.