EUVD-2026-43484Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-accessible unauthenticated endpoint with no complexity; scope unchanged; no confidentiality impact; low integrity and availability impact consistent with voucher manipulation.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in Codemenschen Gift Vouchers gift-voucher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gift Vouchers: from n/a through <= 4.6.9.
AnalysisAI
Missing authorization controls in the Codemenschen Gift Vouchers WordPress plugin (versions through 4.6.9) allow unauthenticated remote attackers to perform unauthorized actions against voucher-related functionality, resulting in low-severity integrity and availability impact. The flaw stems from CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requesting user has rights to access specific functionality - effectively treating restricted endpoints as publicly accessible. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated attack vector (PR:N, AV:N) lowers the bar for opportunistic exploitation significantly.
Technical ContextAI
The affected product is the Gift Vouchers plugin for WordPress, identified via CPE cpe:2.3:a:codemenschen:gift_vouchers:*:*:*:*:*:*:*:*. WordPress plugins enforce access control through capability checks and nonce verification; CWE-862 (Missing Authorization) indicates one or more plugin endpoints or AJAX handlers entirely omit these checks. This class of flaw is endemic to the WordPress plugin ecosystem and typically manifests when a developer registers REST API routes, admin-ajax actions, or shortcode callbacks without calling current_user_can() or equivalent. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication and minimal setup, consistent with an exposed unauthenticated AJAX or REST handler. The integrity (I:L) and availability (A:L) impacts suggest the attacker can manipulate or disrupt voucher records but cannot exfiltrate data (C:N).
RemediationAI
The primary remediation is to update the Gift Vouchers plugin to the version released after 4.6.9; consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/gift-voucher/vulnerability/wordpress-gift-vouchers-plugin-4-6-9-broken-access-control-vulnerability and the WordPress plugin repository changelog to identify the exact patched release - a specific fixed version number is not confirmed in the current intelligence. If an immediate update is not possible, the compensating control with the least trade-off is to deactivate the plugin until patching is feasible, eliminating attack surface entirely at the cost of voucher functionality. Alternatively, a WAF rule blocking unauthenticated access to the plugin's AJAX handlers or REST endpoints identified by the Patchstack report can reduce exposure, though this requires knowing the specific vulnerable endpoint names. Restricting wp-admin and wp-json paths to authenticated sessions via server-level authentication (e.g., HTTP Basic Auth on wp-login.php) adds a layer but may break legitimate storefront functionality.
More in Gift Vouchers
View allThe Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL in
The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/ad
Stored cross-site scripting in the Codemenschen 'Gift Vouchers' WordPress plugin (all versions up to and including 4.7.0
The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized m
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today