2026-10-08 – Version 10.8.1
* Fix – Security: An unauthenticated SQL injection via AES-CTR ciphertext forgery in the recovery link `validate` parameter was possible.
* Fix – Security: An unauthenticated authentication bypass was possible due to malleable encryption and a bypassable HMAC in the recovery link `validate` parameter.
* Fix – Security: An unauthenticated SQL injection was possible via the guest persistent cart `meta_value`. Reported by Wordfence.
* Fix – Security: Auto-login could be triggered without a valid recovery signature.
2026-09-22 – Version 10.8.0
* Fix – Admin emails were not sent for logged-in user carts when the user’s email address was not available in the user meta data for registered users.
* Fix – Security: Added wcap_nonce verification to cart/checkout links in manually resent cart recovery emails (coupon and non-coupon cases), preventing unauthorized triggering of these links.