What is the CVSS score of CVE-2026-54809?

CVE-2026-54809 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of VillaTheme GIFT4U are affected by CVE-2026-54809?

The VillaTheme GIFT4U WordPress plugin contains a critical blind SQL injection vulnerability (CVSS 9.3) affecting versions 1.0.10 and earlier.

How to fix or mitigate CVE-2026-54809?

Within 24 hours: Identify all WordPress instances using GIFT4U v1.0.10 or earlier; immediately deactivate and remove the plugin; review database logs for suspicious SQL patterns. Within 7 days: Document all affected systems and data exposure scope; configure Web Application Firewall rules to block SQL injection attempts; implement database activity monitoring. Within 30 days: Evaluate alternative WordPress plugins for gift functionality; plan and execute migration away from GIFT4U; monitor VillaTheme advisory channels for patch availability; conduct forensic review if exploitation suspected.

VillaTheme GIFT4U CVE-2026-54809

CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wordpress Plugin Gift4U Villatheme

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.4 CRITICAL

Remote unauthenticated SQLi in a WordPress plugin warrants AV:N/AC:L/PR:N/UI:N; I assess S:U and I:H because injection in the same wp database typically allows reads and writes without crossing a security authority.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:26 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection.

This issue affects GIFT4U: from n/a through 1.0.10.

AnalysisAI

Blind SQL injection in the VillaTheme GIFT4U WordPress plugin (versions through 1.0.10) allows remote unauthenticated attackers to inject arbitrary SQL into backend queries via unsanitized user input. The CVSS 9.3 score reflects a scope-changed impact with high confidentiality loss and partial availability impact, though no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

GIFT4U (also marketed as 'Gift Cards All in One for WooCommerce') is a commercial WordPress/WooCommerce plugin from VillaTheme that manages gift card creation, redemption, and balance tracking - operations that inherently involve SQL queries against WordPress and WooCommerce database tables. The root cause is CWE-89: special SQL characters in attacker-supplied input are not neutralized before being concatenated into a query, almost certainly because the plugin bypasses or misuses WordPress's $wpdb->prepare() API. Because the issue is blind, attackers infer data through boolean or time-based response differences rather than seeing direct query output, which is the typical pattern when injection occurs in WHERE clauses of plugin AJAX or REST endpoints.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory documents the issue through version 1.0.10 without naming a fixed release, so administrators should monitor https://patchstack.com/database/wordpress/plugin/gift4u-gift-cards-all-in-one-for-woo/vulnerability/wordpress-gift4u-plugin-1-0-10-sql-injection-vulnerability and VillaTheme's changelog for an update beyond 1.0.10 and apply it immediately when released. As compensating controls, deactivate the GIFT4U plugin until a fix ships (trade-off: gift card functionality unavailable to customers and staff), deploy a WAF rule such as Patchstack's vPatch or Wordfence to block SQL meta-characters on the plugin's AJAX/REST endpoints (trade-off: may produce false positives on legitimate gift-message text containing quotes), restrict the wp-admin and wp-json paths to known IPs where feasible, and ensure the WordPress database user has only the minimum privileges (no FILE, no cross-database access) to limit blast radius if injection succeeds.