EUVD-2026-75261
GHSA-8q26-cm5x-3vpp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WooCommerce store with plugin active
-
DeliveryEnumerate sequential order IDs via unauthenticated endpoint
-
ExploitRetrieve gift card details including customer PII and balance
-
Execution(v3.2.9 only) Extract live redemption code from response
-
ImpactRedeem gift card balance at storefront
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required for exploitation against any WooCommerce store running the Ultimate Gift Cards for WooCommerce plugin between versions 3.0.3 and 3.2.9. The vulnerable endpoint is exposed over standard HTTP/HTTPS with no authentication, no CSRF token, and no IP restriction by default. Exploitation requires: (1) a publicly reachable WooCommerce installation, (2) the plugin installed and active, and (3) at least one order containing a gift card. WooCommerce order IDs are sequential integers, eliminating the need for any prior knowledge of valid order references. The only limiting factor is that gift card redemption code disclosure is specific to version 3.2.9; versions 3.0.3-3.2.8 disclose PII and balance data but not the spendable code. |
| Impact | CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects the disclosure-only scenario for most affected versions. However, for version 3.2.9 specifically, the integrity impact is understated: leaking a spendable redemption code enables direct financial theft, warranting C:H/I:H. SSVC rates Technical Impact as 'partial' and Automatable as 'yes' - the latter is the critical signal: an attacker can script sequential order-ID enumeration and bulk-harvest gift card codes at scale. SSVC Exploitation is rated 'none' by CISA and the CVE is not in KEV, but a public POC exists via WPScan, lowering the barrier substantially. EPSS data is not provided. The combination of no authentication, no rate-limit context noted, sequential order IDs, public POC, and automatable exploitation makes this a meaningful real-world risk for any store running 3.2.9 in particular. Operators on 3.0.3-3.2.8 face PII exposure and GDPR/regulatory liability rather than direct financial loss. |
| Exploit ScenarioDerived | An attacker scripts sequential GET requests to the unauthenticated gift card details endpoint across a target WooCommerce store, enumerating order IDs starting from 1. For each valid order containing a gift card (version 3.2.9), the response returns the live redemption code alongside customer name, email, and balance. The attacker bulk-collects codes and redeems them at the storefront, draining gift card balances without any account access or prior store knowledge. A public POC from WPScan confirms the endpoint and parameter structure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Unauthenticated information disclosure in Ultimate Gift Cards for WooCommerce (WordPress plugin, versions 3.0.3 through 3.2.9) exposes customer PII, gift card balances, and transaction dates tied to arbitrary orders with no authorization check. Version 3.2.9 raises the severity significantly: the live redemption code is also leaked, allowing any anonymous attacker who retrieves it to spend the gift card balance, crossing from information disclosure into tangible financial fraud. A publicly available proof-of-concept was published by WPScan, and the vulnerability is automatable per CISA SSVC, making mass enumeration of orders and gift card theft realistic.
RemediationAI
Upgrade to Ultimate Gift Cards for WooCommerce version 3.2.10 or later, which introduces the missing authorization check on the gift card details endpoint. The vendor-released patch is confirmed available. Any store currently running version 3.2.9 should treat remediation as urgent given the financial fraud risk from exposed redemption codes - beyond patching, consider invalidating or rotating gift card codes issued during the period of exposure. Stores on 3.0.3-3.2.8 should also patch promptly due to PII exposure liability. As an interim measure if immediate patching is not possible, a WAF rule blocking unauthenticated requests to the affected endpoint (identifiable from the WPScan POC at https://wpscan.com/vulnerability/daefdabe-2277-4753-9df5-581134540000/) can reduce exposure, though this may interfere with legitimate gift card display flows and should be tested in staging first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin layered atop WooCommerce, the dominant PHP-based e-commerce platform. The root cause is CWE-200 (Exposure of Sensitive Information) arising from a missing authorization gate on the endpoint that renders gift card details. WordPress REST API or AJAX endpoints without capability checks (e.g., current_user_can()) are a recurring pattern in plugin vulnerabilities. WooCommerce order IDs are typically sequential integers, making them trivially enumerable without any prior knowledge. CPE cpe:2.3:a:unknown:ultimate_gift_cards_for_woocommerce identifies the plugin but carries an unresolved vendor slug ('unknown'), reflecting incomplete NVD/vendor mapping. The two-tier severity split (3.0.3-3.2.8: data disclosure only; 3.2.9: redemption code also exposed) suggests the 3.2.9 release introduced the gift card code into the unauthenticated response - a regression in an otherwise confidentiality-focused endpoint.
Know when Ultimate Gift Cards For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Version 3.2.9 exposes spendable redemption codes enabling financial theft, adding I:H; all other metrics match the unauthenticated network-accessible disclosure pattern.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend.
Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.
Technical POC Analysis
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Ultimate Gift Cards for WooCommerce (versions 3.0.3-3.2.9) allows unauthenticated attackers to access customer personal information, gift card balances, and active redemption codes-enabling them to directly steal funds without authorization. Any WooCommerce store using affected versions faces immediate financial loss, customer data breach obligations, and reputation damage. The exploit is publicly available and easily automated, making large-scale attacks realistic.
Apply vendor patch immediately to all affected installations. Pending deployment, disable the plugin or implement temporary API access controls on order endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Price reconciliation failure in the Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 allows unauthenti
Missing authorization on gift card redemption in Ultimate Gift Cards for WooCommerce (versions before 3.2.10) allows any
The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up
Unauthenticated broken access control in the Ultimate Gift Cards for WooCommerce WordPress plugin (all versions through
The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'defau
Exploit-DB