Ultimate Gift Cards WooCommerce CVE-2026-75861

The attacker must hold a valid, authenticated session on the WordPress site at subscriber level or above - unauthenticated visitors cannot exploit this vulnerability. The attacker must also possess a valid gift card code that was issued to a different user; the code is not guessable from authentication state alone. For the second vulnerable redemption path (present through version 3.2.9), the companion plugin from the same vendor must be installed and active on the same site. Sites running only the core plugin at version 3.2.9 (without the companion plugin) are exposed only through the first redemption path. Sites updated to 3.2.10 are not affected by either path.

Real-world risk is moderate despite the CVSS 6.5 score. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) correctly captures the primary exposure: network-reachable, low-complexity, low-privilege exploitation with high integrity impact. However, two practical constraints reduce urgency beyond what CVSS alone implies. First, the attacker must possess a valid gift card code belonging to another user - obtaining this code is a non-trivial prerequisite not reflected in the AC:L rating, which assumes the code is obtainable. Second, the second vulnerable path requires a companion plugin to be installed and active, limiting blast radius on partial deployments. EPSS at 0.14% (4th percentile) and SSVC exploitation status of 'none' together suggest mass exploitation has not materialized despite a public PoC from WPScan. The financial integrity impact is concrete - real monetary value can be drained - making this a genuine business risk for e-commerce operators even if widespread automated exploitation is not observed.

An attacker who has registered a subscriber account on a WooCommerce store - or has obtained credentials for an existing low-privilege account - acquires a valid gift card code issued to another user (e.g., intercepted from an email, obtained socially, or enumerated if codes have low entropy). The attacker submits that code to the plugin's redemption endpoint, which applies no ownership verification, transfers the full balance to the attacker's account, and zeroes the victim's card. A public proof-of-concept from WPScan demonstrates this flow.