Ultimate Gift Cards for WooCommerce <= 3.2.12 - Unauthenticated Gift Card Price Manipulation via 'wps_wgm_price' Parameter
- ID
- WPSEC-2026-2019
- Plugin
- Ultimate Gift Cards for WooCommerce (woo-gift-cards-lite)
- Affected
- all versions before 3.2.13
- Remediation
- Update to 3.2.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Ultimate Gift Cards for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to price manipulation via the 'wps_wgm_price' parameter in all versions up to, and including, 3.2.12. This is because the add-to-cart handler copies the amount the customer submits for user-priced gift cards into the cart item without checking on the server that it is numeric, positive, or at least the configured minimum. The minimum is only enforced in the browser. This makes it possible for unauthenticated attackers to add gift cards with zero, negative or below-minimum amounts to the cart, which can lower the total of an order that contains other products or yield gift cards below the store's minimum price.
References
- https://wpsec.com/vuln/WPSEC-2026-2019/
- https://plugins.svn.wordpress.org/woo-gift-cards-lite/tags/3.2.13/
- https://wordpress.org/plugins/woo-gift-cards-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS