EUVD-2026-69936
GHSA-jhg7-m2p7-5wfv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated endpoint with only limited data disclosure; no integrity or availability impact confirmed by description.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.
AnalysisAI
Unauthenticated broken access control in the Ultimate Gift Cards for WooCommerce WordPress plugin (all versions through 3.2.9) permits any remote unauthenticated user to reach one or more restricted plugin endpoints, yielding limited information disclosure. The root cause is missing authorization checks (CWE-862) rather than a bypass of the authentication mechanism itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS vector confirms PR:N and AV:N, meaning any remote unauthenticated user can trigger the vulnerable endpoint over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) characterizes this as a Medium-severity, low-complexity, unauthenticated network-accessible flaw with only low confidentiality impact and no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Ultimate Gift Cards for WooCommerce plugin to a version above 3.2.9 via the WordPress admin plugin update screen or WP-CLI. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated information disclosure in Ultimate Gift Cards for WooCommerce (WordPress plugin, versions 3.0.3 through
Price reconciliation failure in the Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 allows unauthenti
Missing authorization on gift card redemption in Ultimate Gift Cards for WooCommerce (versions before 3.2.10) allows any
The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up
The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'defau
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today