EUVD-2026-75261
GHSA-8q26-cm5x-3vpp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Version 3.2.9 exposes spendable redemption codes enabling financial theft, adding I:H; all other metrics match the unauthenticated network-accessible disclosure pattern.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend.
Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.
AnalysisAI
Unauthenticated information disclosure in Ultimate Gift Cards for WooCommerce (WordPress plugin, versions 3.0.3 through 3.2.9) exposes customer PII, gift card balances, and transaction dates tied to arbitrary orders with no authorization check. Version 3.2.9 raises the severity significantly: the live redemption code is also leaked, allowing any anonymous attacker who retrieves it to spend the gift card balance, crossing from information disclosure into tangible financial fraud. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for exploitation against any WooCommerce store running the Ultimate Gift Cards for WooCommerce plugin between versions 3.0.3 and 3.2.9. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects the disclosure-only scenario for most affected versions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Ultimate Gift Cards for WooCommerce version 3.2.10 or later, which introduces the missing authorization check on the gift card details endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WooCommerce instances running Ultimate Gift Cards and confirm version numbers between 3.0.3 and 3.2.9; treat these as active compromise risk. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Price reconciliation failure in the Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 allows unauthenti
Missing authorization on gift card redemption in Ultimate Gift Cards for WooCommerce (versions before 3.2.10) allows any
The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up
Unauthenticated broken access control in the Ultimate Gift Cards for WooCommerce WordPress plugin (all versions through
The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'defau
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today