GIFT4U EUVD-2026-96378

The target must be a WordPress/WooCommerce site with the VillaTheme GIFT4U (gift4u-gift-cards-all-in-one-for-woo) plugin installed and active at version 1.1.3 or earlier. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required and the flaw is reachable against default configurations - the plugin simply fails to enforce an authorization check on a restricted function. The main limiting factor is impact scope: only integrity is affected (VC:N/VI:L/VA:N), so an attacker can tamper with limited gift-card-related data but cannot read confidential data or take the site offline; exploitation also requires the plugin to be present, which narrows the exposed population to GIFT4U users specifically.

This is a medium-severity missing-authorization flaw (CWE-862) in the VillaTheme GIFT4U WooCommerce plugin, versions up to 1.1.3. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N) indicates a network-reachable, low-complexity attack requiring no privileges and no user interaction, but with impact limited to low integrity only - no confidentiality or availability impact - which is consistent with a broken-access-control issue that lets an unauthorized actor modify or trigger a restricted function rather than steal data or crash the site. The 6.9 score reflects this bounded impact. No EPSS probability, no CISA KEV listing, and no proof-of-concept are present in the supplied data, so there is no public exploit identified at time of analysis; exploitation is theoretically easy (unauthenticated, remote) but the real-world payoff is constrained by the integrity-only impact. Net assessment: a genuine but not top-tier priority - patch during normal cycles for sites running this plugin, prioritizing e-commerce stores where gift-card integrity matters. No signals conflict, though the absence of EPSS/KEV/POC data means exploitation likelihood is unquantified rather than confirmed-low.

A remote, unauthenticated attacker sends a crafted HTTP request directly to a GIFT4U plugin endpoint that fails to verify the caller's authorization, allowing them to invoke a gift-card management action they should not have access to. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no login, user interaction, or special timing is needed, but impact is confined to integrity (VC:N/VI:L/VA:N), so the attacker can tamper with limited plugin data rather than read sensitive data or disrupt the site. No public proof-of-concept is identified in the available data.