CVE-2026-24375

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24375", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-22T14:42:40.516Z", "datePublished": "2026-02-19T08:26:50.736Z", "dateUpdated": "2026-04-28T16:14:48.126Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "woo-gift-cards-lite", "product": "Ultimate Gift Cards For WooCommerce", "vendor": "WP Swings", "versions": [{"changes": [{"at": "3.2.5", "status": "unaffected"}], "lessThanOrEqual": "3.2.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "PPzzAArr | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:18.031Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in WP Swings Ultimate Gift Cards For WooCommerce woo-gift-cards-lite allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Ultimate Gift Cards For WooCommerce: from n/a through <= 3.2.4.</p>"}], "value": "Missing Authorization vulnerability in WP Swings Ultimate Gift Cards For WooCommerce woo-gift-cards-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Gift Cards For WooCommerce: from n/a through <= 3.2.4."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:48.126Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/woo-gift-cards-lite/vulnerability/wordpress-ultimate-gift-cards-for-woocommerce-plugin-3-2-4-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T21:18:03.379753Z", "id": "CVE-2026-24375", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:02:17.819Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24375", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-22T14:42:40.516Z", "datePublished": "2026-02-19T08:26:50.736Z", "dateUpdated": "2026-04-28T14:02:17.819Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "woo-gift-cards-lite", "product": "Ultimate Gift Cards For WooCommerce", "vendor": "WP Swings", "versions": [{"changes": [{"at": "3.2.5", "status": "unaffected"}], "lessThanOrEqual": "3.2.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "PPzzAArr | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-28T13:26:17.584Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in WP Swings Ultimate Gift Cards For WooCommerce woo-gift-cards-lite allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Ultimate Gift Cards For WooCommerce: from n/a through <= 3.2.4.</p>"}], "value": "Missing Authorization vulnerability in WP Swings Ultimate Gift Cards For WooCommerce woo-gift-cards-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Gift Cards For WooCommerce: from n/a through <= 3.2.4."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T12:10:44.645Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/woo-gift-cards-lite/vulnerability/wordpress-ultimate-gift-cards-for-woocommerce-plugin-3-2-4-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability"}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24375", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T21:18:03.379753Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:17:20.051Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "woo-gift-cards-lite", "product": "Ultimate Gift Cards For WooCommerce", "vendor": "WP Swings", "versions": [{"changes": [{"at": "3.2.5", "status": "unaffected"}], "lessThanOrEqual": "3.2.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in WP Swings Ultimate Gift Cards For WooCommerce woo-gift-cards-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Gift Cards For WooCommerce: from n/a through <= 3.2.4."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en WP Swings Ultimate Gift Cards para WooCommerce woo-gift-cards-lite permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Ultimate Gift Cards para WooCommerce: desde n/a hasta &lt;= 3.2.4."}], "id": "CVE-2026-24375", "lastModified": "2026-06-17T10:22:58.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24375", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T21:18:03.379753Z", "version": "2.0.3"}}]}, "published": "2026-02-19T09:16:13.497", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/woo-gift-cards-lite/vulnerability/wordpress-ultimate-gift-cards-for-woocommerce-plugin-3-2-4-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.2.4]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.2.5"}}], "enrichment": {"confidence": 99.0, "confidence_source": "matching", "scores": [{"score": 99.0, "source": "matching"}]}, "original": {"product": "Ultimate Gift Cards For WooCommerce", "source": "cna", "vendor": "WP Swings"}, "product": "ultimate_gift_cards_for_woocommerce", "vendor": "wpswings"}], "analysis": {"en": {"generated_at": "2026-04-16T00:37:07.554406+00:00", "value": {"mitigation_remediation": ["Upgrade the WP Swings Ultimate Gift Cards For WooCommerce plugin to the latest released version that resolves the authorization issue.", "If the latest version cannot be applied immediately, limit access to the plugin\u2019s administrative endpoints to users with administrator or shop manager roles only, and review existing role permissions.", "If gift card functionality is not essential at the time, consider disabling or uninstalling the plugin until the issue is fixed."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Vendors impacted are WP Swings\u2019 Ultimate Gift Cards For WooCommerce, commonly known as woo\u2011gift\u2011cards\u2011lite. All installations of the plugin up to version 3.2.4 are affected. This includes environments that have not applied the latest patch, as the issue exists from the earliest release through 3.2.4.", "description_and_impact": "The vulnerability is a missing authorization flaw in the WP Swings Ultimate Gift Cards For WooCommerce plugin. Incorrectly configured access control allows attackers to perform privileged actions, such as creating, modifying, or deleting gift cards, without proper permission. The flaw maps to CWE\u2011862 and could lead to unauthorized manipulation of store inventory and financial data.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate level of severity, while the EPSS score of less than 1\u202f% signals that the vulnerability has a low probability of being exploited at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to send crafted requests to the plugin\u2019s exposed endpoints; the missing authorization check makes the exploit relatively straightforward for anyone with access to the site\u2019s back\u2011end. Based on the description, this vulnerability is likely exploitable via the web interface. Given the moderate impact and low exploit reputation, the risk is moderate but still warrants prompt mitigation."}}}}, "created": "2026-02-20T10:11:13.626179+00:00", "updated": "2026-04-16T00:45:15.966801+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpswings", "wpswings$PRODUCT$ultimate_gift_cards_for_woocommerce"]}