What is the CVSS score of CVE-2026-57324?

CVE-2026-57324 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

GIFT4U Plugin CVE-2026-57324

EUVD-2026-39736 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-qcv7-9h48-x73r

WordPress Authentication Bypass Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable with no credentials or interaction required; impact limited to integrity and availability within the plugin's own scope, with no confidentiality exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:18 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.

AnalysisAI

Broken access control in the GIFT4U WordPress plugin (versions ≤ 1.0.10) exposes unauthenticated endpoints that allow remote attackers to perform unauthorized operations against WooCommerce gift card functionality. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special configuration beyond plugin installation. Reported by Patchstack (audit@patchstack.com) and cataloged under EUVD-2026-39736, this is no public exploit identified at time of analysis, but the trivial exploitation conditions lower the practical bar for abuse.

Technical ContextAI

CWE-862 (Missing Authorization) describes a failure to verify that a requesting party holds permission to access a resource or execute an action. In the WordPress/WooCommerce plugin ecosystem, this most commonly manifests as AJAX action handlers or REST API routes registered without nonce verification or WordPress capability checks (e.g., current_user_can()). The GIFT4U plugin - a gift card management extension for WooCommerce - exposes at least one such unprotected endpoint, allowing any network-reachable client to trigger privileged operations. The CVE tag 'Authentication Bypass' further reinforces that the missing check is the authorization gate itself, not a circumvention of an existing check.

RemediationAI

No patched version number is specified in the available intelligence data - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/gift4u-gift-cards-all-in-one-for-woo/vulnerability/wordpress-gift4u-plugin-1-0-10-broken-access-control-vulnerability should be checked for a confirmed fix release. As an immediate compensating control, deactivate the GIFT4U plugin on any publicly accessible WooCommerce instance until a patched version is confirmed; this eliminates the attack surface entirely at the cost of disabling gift card functionality. If deactivation is not operationally acceptable, restrict access to WordPress AJAX and REST API endpoints (/wp-admin/admin-ajax.php and /wp-json/) via WAF rules or IP allowlisting to trusted networks only, accepting the trade-off of breaking public storefront interactions. Monitor the WordPress plugin repository and Patchstack for an updated release.