Security readout for executives and security teams
Plain-English summary
A critical flaw in Abandoned Cart Pro for WooCommerce through version 10.4.0 may allow an unauthenticated internet user to gain elevated WordPress privileges. Successful compromise could expose store and customer data, enable unauthorized changes, and disrupt the site. The supplied sources do not describe the underlying flaw in detail.
Executive priority
Treat as an immediate remediation and compromise-assessment priority for affected internet-facing stores. The potential business impact includes customer-data exposure, fraudulent administrative changes, storefront disruption, and recovery costs. Do not claim an incident solely from product presence; investigate for evidence while applying vendor-supported remediation.
Technical view
CVE-2026-66682 is an unauthenticated privilege-escalation vulnerability classified as CWE-266. Its CVSS 3.1 score is 9.8, with network access, low complexity, no privileges, and no user interaction required. The reported impact is high across confidentiality, integrity, and availability. A precise vulnerable function or request path is not provided.
Likely exposure
Internet-accessible WordPress and WooCommerce sites running the active Abandoned Cart Pro for WooCommerce plugin at version 10.4.0 or earlier are the likely exposure. The bundle does not establish whether configuration, licensing, or optional features affect exploitability. Confirm deployments individually.
Exploitation context
The CVSS vector indicates remote, unauthenticated exploitation without user interaction. However, the supplied bundle reports no CISA KEV listing and provides no evidence of active exploitation, public proof-of-concept code, or exploitation at scale. Treat the technical exploitation status as unconfirmed.
Researcher notes
The public bundle is sparse: it identifies unauthenticated privilege escalation through 10.4.0 but does not disclose root cause, affected endpoints, prerequisites, indicators, patch details, or a fixed release. The affected-product record also contains an unspecified version field, so the title and description provide the usable version boundary.
Mitigation direction
- Inventory all WordPress sites for this plugin and record installed versions.
- Check Tyche Softwares and Patchstack guidance for a confirmed fixed version or vendor mitigation.
- Prioritize remediation for internet-facing stores running version 10.4.0 or earlier.
- If no fix is available, assess temporarily disabling the plugin until vendor guidance is published.
- Preserve relevant WordPress, web-server, authentication, and administrative audit logs.
Validation and detection
- Confirm the plugin version and activation state on every WordPress instance.
- Verify any replacement version is explicitly identified by the vendor as non-vulnerable.
- Review administrator accounts and role changes for unexplained creation or elevation.
- Examine recent logs for unexpected administrative actions or plugin configuration changes.
- Retest inventory after remediation to ensure no affected deployment remains.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-266: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-66682 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9PatchstackVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Privilege Assignment
Incorrect Privilege Assignment represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.