Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-19439

Ultimate Gift Cards for WooCommerce · Vulnerability

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-19439

Published

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-19439

Published

Ultimate Gift Cards for WooCommerce

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Ultimate Gift Cards for WooCommerce",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "3.0.3",
                            "lessThan": "3.2.10"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON