EUVD-2026-74703
GHSA-qxjq-m6c6-hvh9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable redemption endpoint requires authenticated subscriber (PR:L); no confidentiality or availability impact; integrity is high as monetary balances are directly manipulated.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value to themselves.
In 3.2.9 an ownership check was added on one of the two affected redemption paths; the one that remains requires a companion Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 from the same vendor to be active.
AnalysisAI
Missing authorization on gift card redemption in Ultimate Gift Cards for WooCommerce (versions before 3.2.10) allows any authenticated subscriber to redeem gift cards belonging to other users, zeroing the victim's balance and crediting the full value to the attacker's own account. Two separate redemption code paths are affected: version 3.2.9 patched one path but left a second path vulnerable when a companion plugin from the same vendor is active; both paths are fully remediated in 3.2.10. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid, authenticated session on the WordPress site at subscriber level or above - unauthenticated visitors cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate despite the CVSS 6.5 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Ultimate Gift Cards for WooCommerce plugin to version 3.2.10 or later, which closes both affected redemption paths. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated information disclosure in Ultimate Gift Cards for WooCommerce (WordPress plugin, versions 3.0.3 through
Price reconciliation failure in the Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 allows unauthenti
The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up
Unauthenticated broken access control in the Ultimate Gift Cards for WooCommerce WordPress plugin (all versions through
The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'defau
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today