{
 "id": "WPSEC-2026-2019",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2019/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2019/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2019/index.md",
 "title": "Ultimate Gift Cards for WooCommerce <= 3.2.12 - Unauthenticated Gift Card Price Manipulation via 'wps_wgm_price' Parameter",
 "description": "The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to price manipulation via the 'wps_wgm_price' parameter in all versions up to, and including, 3.2.12. This is because the add-to-cart handler copies the amount the customer submits for user-priced gift cards into the cart item without checking on the server that it is numeric, positive, or at least the configured minimum. The minimum is only enforced in the browser. This makes it possible for unauthenticated attackers to add gift cards with zero, negative or below-minimum amounts to the cart, which can lower the total of an order that contains other products or yield gift cards below the store's minimum price.",
 "plugin": {
  "slug": "woo-gift-cards-lite",
  "name": "Ultimate Gift Cards for WooCommerce",
  "full_name": "Ultimate Gift Cards for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woo-gift-cards-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woo-gift-cards-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woo-gift-cards-lite"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.2.13",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.2.13"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.2.13",
 "remediation": "Update to 3.2.13 or later.",
 "fix_released": "2026-10-29T09:17:48+00:00",
 "published": "2026-10-30T09:42:55+00:00",
 "updated": "2026-10-29T17:43:56.187353+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2019/",
  "https://plugins.svn.wordpress.org/woo-gift-cards-lite/tags/3.2.13/",
  "https://wordpress.org/plugins/woo-gift-cards-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woo-gift-cards-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}