CVE-2026-19439 in Ultimate Gift Cards for WooCommerce Plugin
Summary
by MITRE • 09/10/2026
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend.
Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within The Ultimate Gift Cards for WooCommerce WordPress plugin prior to version 3.2.10 represents a critical failure in access control mechanisms, specifically categorized under CWE-862: Missing Authorization. This flaw stems from an absence of proper authentication and authorization checks when the application processes requests to retrieve gift card details associated with specific orders. In secure software architecture, any operation that exposes sensitive data or allows financial transactions must verify that the requesting user has legitimate ownership or administrative privileges over the target resource. The plugin fails to enforce this principle, allowing unauthenticated actors to interact directly with the underlying API endpoints responsible for fetching gift card information. By manipulating parameters such as order IDs, an attacker can bypass any implicit trust assumptions and access data belonging to arbitrary users who have purchased gift cards through the WooCommerce store.
The operational impact of this vulnerability is severe due to the nature of the data exposed. For versions ranging from 3.0.3 to 3.2.8, the flaw allows attackers to disclose sensitive customer personal information alongside financial details. This includes names, email addresses, and potentially other personally identifiable information linked to the orders containing gift cards. Furthermore, the attacker can retrieve the current balances of these accounts and their expiration dates. While this constitutes a significant privacy breach under regulations such as GDPR or CCPA, it also facilitates targeted phishing attacks where attackers possess accurate personal details to increase social engineering success rates. The exposure of financial data alone undermines customer trust and exposes merchants to potential liability for failing to protect user information during transactions.
In version 3.2.9 specifically, the severity escalates dramatically because the vulnerability extends to the disclosure of live redemption codes. Unlike static balances or personal metadata, a valid redemption code is equivalent to currency within the context of the application ecosystem. Possession of this code allows an unauthenticated user to redeem the gift card value immediately, resulting in direct financial loss for either the customer who purchased it or the merchant if the funds were prepaid and not yet settled. This transforms the vulnerability from a data privacy issue into a critical integrity and availability threat, enabling unauthorized transfer of assets. The ability to spend these codes without any verification means that once an order ID is guessed or enumerated, the associated financial value can be drained instantly by malicious actors scanning for vulnerable instances.
From a tactical perspective, this exploitation aligns with MITRE ATT&CK techniques related to Collection and Exfiltration over Application Layer Communication. Attackers typically utilize automated scripts to enumerate valid order IDs through brute force or information leakage from other sources such as public URLs or sitemap files. Once a valid ID is identified, the attacker sends crafted HTTP requests to the vulnerable endpoint without providing any session cookies or authentication tokens. The server processes these requests and returns the full gift card payload because it lacks logic to validate that the requester is the owner of the order. This pattern highlights a common misconfiguration in WordPress plugins where REST API endpoints are registered with overly permissive capabilities, failing to restrict access based on user roles or resource ownership.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary action required is upgrading The Ultimate Gift Cards for WooCommerce plugin to version 3.2.10 or later, where the developers have implemented proper authorization checks to ensure that only authenticated users with appropriate permissions can access gift card details. For organizations unable to upgrade immediately due to compatibility constraints, temporary mitigations include restricting access to WordPress admin areas via IP whitelisting if applicable, although this is less effective for public-facing REST endpoints. Additionally, implementing a Web Application Firewall (WAF) rule that monitors for unusual patterns of order ID enumeration and blocks requests lacking valid session tokens can provide an interim layer of defense. Merchants should also audit their WooCommerce settings to ensure that any exposed APIs are strictly limited to authenticated users only, reviewing custom code or third-party integrations that might inadvertently expose sensitive endpoints. Regular security audits focusing on access control logic in e-commerce plugins are essential to prevent similar vulnerabilities from being introduced in future updates.