Ultimate Gift Cards EUVD-2026-69936

No authentication is required - the CVSS vector confirms PR:N and AV:N, meaning any remote unauthenticated user can trigger the vulnerable endpoint over the network. The plugin must be installed and active on a WordPress site running WooCommerce. The affected endpoint is reachable via standard HTTP(S); no special network position (e.g., LAN adjacency) is required. Exploitation is limited in impact to low-confidence information disclosure (C:L); there is no integrity or availability consequence, ruling out data modification or denial-of-service. Exploitation requires no user interaction and no elevated browser or client-side preconditions.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) characterizes this as a Medium-severity, low-complexity, unauthenticated network-accessible flaw with only low confidentiality impact and no integrity or availability consequences. The absence of CISA KEV listing and publicly confirmed exploit code keeps real-world urgency moderate; even a mid-sized municipal IT team in bytom running WooCommerce stores should treat this as a scheduled patch rather than an emergency response. EPSS data is not present in the input, so exploitation probability cannot be quantified. The practical risk is bounded by the C:L scope - the exposed data is limited rather than wholesale credential or payment data exfiltration. The tag 'Authentication Bypass' overstates the class of vulnerability; this is an authorization gap, not a bypass of WordPress session or credential validation, which limits attacker pivot potential beyond the disclosed data.

An unauthenticated attacker identifies a WooCommerce storefront running Ultimate Gift Cards for WooCommerce ≤ 3.2.9 via plugin enumeration or public plugin disclosure in page source. The attacker sends a crafted HTTP request directly to the unprotected plugin endpoint - such as an AJAX action or REST route - without supplying any authentication credentials or nonce. The server processes the request and returns restricted gift card or order-related data that should require at minimum subscriber-level authentication.