CVE-2026-19439
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.
Risk Assessment
An unauthenticated attacker can access customer personal data, gift card balances, and redemption codes, leading to theft of funds and privacy breach.
Recommendation
Upgrade the Ultimate Gift Cards for WooCommerce plugin to version 3.2.10 or later. Until then, consider disabling the gift card details display feature.
Other vulnerabilities in Ultimate Gift Cards for WooCommerce WordPress plugin
Original NVD description (English source)
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS