CVE-2026-57412

MediumCVSS 6.5

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

The Gift Vouchers plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.6.9.

Risk Assessment

An attacker can gain unauthorized access to gift voucher management functions, potentially leading to data theft or unauthorized voucher generation.

Recommendation

Immediately update the Gift Vouchers plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in Gift Vouchers

CVE-2026-57415High
The Gift Vouchers plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 4.7.0.

Original NVD description (English source)

Missing Authorization vulnerability in Codemenschen Gift Vouchers gift-voucher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gift Vouchers: from n/a through <= 4.6.9.