EUVD-2026-75260
GHSA-5j4r-9728-477v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Publicly reachable checkout endpoint, no authentication required, low complexity per public POC; integrity impact high due to fraudulent coupon issuance; no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.
AnalysisAI
Price reconciliation failure in the Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 allows unauthenticated users to obtain gift card coupons worth more than they actually paid at checkout. The plugin issues coupon codes without verifying that the face value matches the payment amount collected by WooCommerce, creating a directly monetizable fraud vector against any store running the affected plugin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WooCommerce store must have the Ultimate Gift Cards for WooCommerce plugin installed, active, and configured to allow gift card purchases via the checkout flow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N accurately reflects the core risk profile - fully remote, zero authentication, low complexity, with high integrity impact through fraudulent store credit generation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Ultimate Gift Cards for WooCommerce plugin to version 3.2.10 or later, which introduces proper server-side reconciliation between the coupon face value and the settled payment amount. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your WordPress installation to confirm whether Ultimate Gift Cards for WooCommerce is active and identify the current plugin version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated information disclosure in Ultimate Gift Cards for WooCommerce (WordPress plugin, versions 3.0.3 through
Missing authorization on gift card redemption in Ultimate Gift Cards for WooCommerce (versions before 3.2.10) allows any
The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up
Unauthenticated broken access control in the Ultimate Gift Cards for WooCommerce WordPress plugin (all versions through
The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'defau
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today