Ultimate Gift Cards for WooCommerce CVE-2026-19436

The target WooCommerce store must have the Ultimate Gift Cards for WooCommerce plugin installed, active, and configured to allow gift card purchases via the checkout flow. No authentication is required - the CVSS vector PR:N confirms exploitation is available to any anonymous visitor who can reach the store's public checkout. No special network position or user interaction is needed (AV:N/AC:L/UI:N). The primary limiting factor is that gift card sales must be enabled; stores with the plugin installed but gift card purchasing disabled would not expose the vulnerable code path.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N accurately reflects the core risk profile - fully remote, zero authentication, low complexity, with high integrity impact through fraudulent store credit generation. The low attack complexity aligns with a publicly available WPScan exploit, confirming the technique is repeatable without specialized skill. Even a mid-sized online retailer in inowroclaw running WooCommerce should treat this as an urgent remediation item, since inflated gift card codes are directly monetizable through resale or redemption with minimal friction. No CISA KEV listing is present at time of analysis, but the combination of PR:N, a public POC, and the broad deployment footprint of WooCommerce collectively elevate near-term exploitation probability substantially above baseline. EPSS data was not provided in the available intelligence sources.

An attacker visits a WooCommerce store with the vulnerable plugin enabled, adds a gift card to the cart at a low purchase price, and manipulates the checkout request to submit a lower payment amount while retaining the coupon issuance at the original face value. The publicly available WPScan exploit confirms this is achievable with minimal technical skill. The resulting inflated coupon code can then be redeemed for merchandise or resold for profit.