CVE-2026-75861 Details
Description
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value to themselves. In 3.2.9 an ownership check was added on one of the two affected redemption paths; the one that remains requires a companion Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 from the same vendor to be active.
A vulnerability exists in the Ultimate Gift Cards for WooCommerce WordPress plugin in versions prior to 3.2.10. The plugin fails to ensure that the user redeeming a gift card is the intended recipient. This flaw allows any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, depleting their balance and transferring the value to themselves. While version 3.2.9 introduced an ownership check for one of the two affected redemption paths, the remaining path still lacks proper verification, unless a companion plugin from the same vendor is active.
Users are advised to update the Ultimate Gift Cards for WooCommerce WordPress plugin to version 3.2.10 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 9, 2026CISA-ADP
Assessed Sep 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/a08125a6-e528-49f1-82c4-191df80af26c/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Ultimate Gift Cards | < 3.2.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 9, 2026 | New CVE Received | [email protected] |