CVE-2026-19439

The Ultimate Gift Cards for WooCommerce WordPress plugin before version 3.2.10 lacks an authorization check when displaying gift card details, allowing any unauthenticated visitor to retrieve the gift cards attached to arbitrary orders. An attacker who can trigger this display for orders on a vulnerable store obtains customer personal data, gift card balances and dates; on version 3.2.9 the live redemption code is also exposed, which anyone holding it can redeem. Versions 3.0.3 through 3.2.8 disclose the same data but without the redemption code. Any WooCommerce store running the plugin in the affected range is exposed, with risk concentrated on stores that actively sell gift cards. There is no known public proof-of-concept and the flaw is not in CISA's KEV, so confirmed in-the-wild exploitation has not been reported.

What to do: Upgrade Ultimate Gift Cards for WooCommerce to version 3.2.10 or later. Stores that ran version 3.2.9 should review gift card orders for unauthorized redemptions and consider reissuing any redemption codes that may have been exposed. As an interim mitigation, restrict unauthenticated requests to the plugin's gift card display functionality (e.g., via WAF rules) until the update is applied.