CVE-2026-19436

HighCVSS 7.5

Published: 10/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 10/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.

Risk Assessment

An unauthenticated attacker can obtain store credit worth more than they paid, leading to financial losses for the store.

Recommendation

Upgrade the Ultimate Gift Cards for WooCommerce plugin to version 3.2.10 or later. Until then, consider disabling gift card sales.

Other vulnerabilities in Ultimate Gift Cards for WooCommerce WordPress plugin

CVE-2026-19439High
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS