Vulnerabilities / Shopping Cart & eCommerce Store / WPSEC-2026-2159
Shopping Cart & eCommerce Store <= 6.0.5 - Unauthenticated Gift Card Brute-Force Protection Bypass
Low 3.7
CWE-307Fixed in 6.0.6
- ID
- WPSEC-2026-2159
- Plugin
- WP EasyCart: Shopping Cart and eCommerce Store (wp-easycart)
- Affected
- from 6.0.2 before 6.0.6
- Remediation
- Update to 6.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-307
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Shopping Cart & eCommerce Store on WPSec AttackSurface
- Fix released
- Published
Description
The WP EasyCart plugin for WordPress is vulnerable to a brute-force protection bypass via the ec_ajax_redeem_gift_card AJAX action in versions 6.0.2 up to, and including, 6.0.5, due to the submitted gift card number being saved to the cart session before the checkout guard's guess limit was checked. This makes it possible for unauthenticated attackers to keep guessing gift card numbers after the limit is reached, and a correct guess still applies the card's balance to their order, which the returned totals reveal.
References
- https://wpsec.com/vuln/WPSEC-2026-2159/
- https://plugins.svn.wordpress.org/wp-easycart/tags/6.0.6/
- https://wordpress.org/plugins/wp-easycart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS