Gift Cards For WooCommerce Pro CVE-2026-45444

The target must be a WordPress site with WP Swings Gift Cards For WooCommerce Pro plugin versions through 4.2.6 installed and activated, with the plugin's file-upload functionality reachable over the network - per the CVSS PR:N/UI:N vector, no authentication and no user interaction are required, so any internet-facing site running the vulnerable plugin is exploitable against its default configuration. Limiting factors are narrow: exploitation depends only on the plugin being present and its upload endpoint being network-reachable, with no documented requirement for specific WooCommerce configuration, gift-card feature activation beyond default install, or particular WordPress version. The S:C scope change implies the writable upload destination must be in a location where the web server will execute uploaded content, which is the typical default WordPress configuration.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H represents the maximum-severity profile: network reachable, low complexity, no privileges, no user interaction, with scope change and high impact across confidentiality, integrity, and availability - producing the 10.0 score. The scope change (S:C) indicates compromise extends beyond the plugin into the underlying WordPress/host environment, consistent with web-shell deployment outcomes. No EPSS score, KEV listing, or SSVC data was provided in the input, so real-world exploitation probability cannot be quantified from the available signals; however, file upload vulnerabilities in WordPress plugins are historically high-value targets routinely incorporated into automated scanning and mass-exploitation toolkits. No public exploit was identified at time of analysis, but the trivial exploitation profile means defenders should not treat the absence of POC as meaningful risk reduction.

An unauthenticated attacker identifies a WordPress site running WooCommerce with the Gift Cards For WooCommerce Pro plugin and submits a crafted HTTP POST request to the plugin's gift-card upload endpoint, supplying a PHP web shell disguised as or in place of a gift-card image. Because file type validation is insufficient, the malicious file lands in a web-accessible directory and the attacker invokes it directly via browser to gain remote code execution under the web server account, pivoting to full WordPress and host compromise. The scope-changed CVSS rating suggests impact extends beyond the plugin context to the host environment.