CVE-2026-19436 PUBLISHED

Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase

Assigner: WPScan
Reserved: 10.08.2026 Published: 10.09.2026 Updated: 10.09.2026

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.

Product Status

Vendor Unknown
Product Ultimate Gift Cards for WooCommerce
Versions Default: unaffected
  • affected from 0 to 3.2.10 (excl.)

Credits

  • Guillermo Álvarez Fernández finder
  • WPScan coordinator

References

Problem Types

  • CWE-284 Improper Access Control CWE