# Ultimate Gift Cards for WooCommerce <= 3.2.12 - Unauthenticated Gift Card Price Manipulation via 'wps_wgm_price' Parameter

- **ID:** WPSEC-2026-2019
- **Plugin:** Ultimate Gift Cards for WooCommerce (`woo-gift-cards-lite`), https://wordpress.org/plugins/woo-gift-cards-lite/
- **Affected versions:** all versions before 3.2.13
- **Fixed in:** 3.2.13 (Update to 3.2.13 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-gift-cards-lite
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2019/

## Description

The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to price manipulation via the 'wps_wgm_price' parameter in all versions up to, and including, 3.2.12. This is because the add-to-cart handler copies the amount the customer submits for user-priced gift cards into the cart item without checking on the server that it is numeric, positive, or at least the configured minimum. The minimum is only enforced in the browser. This makes it possible for unauthenticated attackers to add gift cards with zero, negative or below-minimum amounts to the cart, which can lower the total of an order that contains other products or yield gift cards below the store's minimum price.

## References

- https://wpsec.com/vuln/WPSEC-2026-2019/
- https://plugins.svn.wordpress.org/woo-gift-cards-lite/tags/3.2.13/
- https://wordpress.org/plugins/woo-gift-cards-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2019/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.