What is the CVSS score of CVE-2026-45444?

CVE-2026-45444 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Gift Cards For WooCommerce Pro are affected by CVE-2026-45444?

WP Swings Gift Cards For WooCommerce Pro (versions ≤4.2.6) contains a CVSS 10.0 critical vulnerability enabling unauthenticated remote code execution and complete site takeover.

How to fix or mitigate CVE-2026-45444?

Within 24 hours: Immediately deactivate WP Swings Gift Cards For WooCommerce Pro across all WordPress instances; backup all databases and site data before making changes. Within 7 days: Conduct forensic analysis for indicators of compromise; contact vendor for patch availability timeline. Within 30 days: Deploy patched version when released or migrate to alternative gift card solution if patch delivery exceeds 30 days.

Gift Cards For WooCommerce Pro CVE-2026-45444

EUVD-2026-31149 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-20 Patchstack

GHSA-w7h5-vx9m-v9jx

File Upload WordPress

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 20:00 vuln.today

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files.

This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6.

AnalysisAI

Unrestricted file upload in WP Swings Gift Cards For WooCommerce Pro plugin (versions up to and including 4.2.6) allows remote unauthenticated attackers to upload malicious files of dangerous types to vulnerable WordPress sites. With a maximum CVSS score of 10.0 and a scope-changed vector, successful exploitation typically leads to remote code execution and full site compromise. No public exploit identified at time of analysis, though the high severity and ease of exploitation make this a priority concern for any WooCommerce site using this plugin.

Technical ContextAI

The vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), a well-known weakness class where an application accepts uploaded files without adequately validating their type, extension, content, or destination. The affected component is the Gift Cards For WooCommerce Pro plugin by WP Swings (CPE: cpe:2.3:a:wp_swings:gift_cards_for_woocommerce_pro), a commercial extension for the WooCommerce e-commerce platform on WordPress. Gift card plugins commonly accept user-supplied images or PDFs for personalized gift card designs, and insufficient validation in these upload handlers typically allows attackers to drop PHP files or other server-executable content into web-accessible directories, where they can be invoked directly via HTTP.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory describes the issue as affecting versions through 4.2.6 with no confirmed fixed release in the provided data, so administrators should check the WP Swings vendor portal and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/giftware/vulnerability/wordpress-gift-cards-for-woocommerce-pro-plugin-4-2-6-arbitrary-file-upload-vulnerability for an updated version above 4.2.6 and apply it immediately when available. Until a fix is confirmed, deactivate and remove the Gift Cards For WooCommerce Pro plugin (which disables gift card functionality but eliminates the attack surface entirely), or place the plugin's upload endpoints behind a Web Application Firewall rule that blocks requests carrying executable file extensions (.php, .phtml, .phar, .jsp) or non-image MIME types, and additionally configure the web server to deny PHP execution within the wp-content/uploads directory via .htaccess or Nginx location rules - note this last control may break legitimate plugins that rely on dynamic content under uploads. Conduct a compromise assessment looking for unexpected files in wp-content/uploads and recent administrator account creation.