{
 "id": "WPSEC-2026-2159",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2159/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2159/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2159/index.md",
 "title": "Shopping Cart & eCommerce Store <= 6.0.5 - Unauthenticated Gift Card Brute-Force Protection Bypass",
 "description": "The WP EasyCart plugin for WordPress is vulnerable to a brute-force protection bypass via the ec_ajax_redeem_gift_card AJAX action in versions 6.0.2 up to, and including, 6.0.5, due to the submitted gift card number being saved to the cart session before the checkout guard's guess limit was checked. This makes it possible for unauthenticated attackers to keep guessing gift card numbers after the limit is reached, and a correct guess still applies the card's balance to their order, which the returned totals reveal.",
 "plugin": {
  "slug": "wp-easycart",
  "name": "Shopping Cart & eCommerce Store",
  "full_name": "WP EasyCart: Shopping Cart and eCommerce Store",
  "wordpress_org": "https://wordpress.org/plugins/wp-easycart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-easycart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-easycart"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-307"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "6.0.2",
    "from_inclusive": true,
    "to": "6.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 6.0.2 before 6.0.6"
  ]
 },
 "introduced_in": "6.0.2",
 "fixed_in": "6.0.6",
 "remediation": "Update to 6.0.6 or later.",
 "fix_released": "2026-10-29T22:06:57+00:00",
 "published": "2026-10-30T22:49:06+00:00",
 "updated": "2026-10-30T09:32:58.994340+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2159/",
  "https://plugins.svn.wordpress.org/wp-easycart/tags/6.0.6/",
  "https://wordpress.org/plugins/wp-easycart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-easycart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}