CVE-2026-84760

MediumCVSS 5.3

Published: 02/09/2026(UTC)Updated: 02/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Summary

Unauthenticated Broken Access Control vulnerability in Ultimate Gift Cards For WooCommerce versions up to 3.2.9. An attacker without authentication can bypass access controls.

Risk Assessment

Potential for unauthorized operations, potentially leading to data integrity issues or unauthorized changes.

Recommendation

Update the Ultimate Gift Cards For WooCommerce plugin to the latest version with security fixes.

Other vulnerabilities in Ultimate Gift Cards For WooCommerce

CVE-2026-75861Medium
The Ultimate Gift Cards for WooCommerce plugin before version 3.2.10 does not verify that the user redeeming a gift card is its intended recipient. This allows any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value to themselves. In version 3.2.9 an ownership check was added on one of the two affected redemption paths; the one that remains requires a companion Ultimate Gift Cards for WooCommerce plugin before 3.2.10 from the same vendor to be active.

Original NVD description (English source)

Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS