# Shopping Cart & eCommerce Store <= 6.0.5 - Unauthenticated Gift Card Brute-Force Protection Bypass

- **ID:** WPSEC-2026-2159
- **Plugin:** WP EasyCart: Shopping Cart and eCommerce Store (`wp-easycart`), https://wordpress.org/plugins/wp-easycart/
- **Affected versions:** from 6.0.2 before 6.0.6
- **Fixed in:** 6.0.6 (Update to 6.0.6 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-307
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-easycart
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2159/

## Description

The WP EasyCart plugin for WordPress is vulnerable to a brute-force protection bypass via the ec_ajax_redeem_gift_card AJAX action in versions 6.0.2 up to, and including, 6.0.5, due to the submitted gift card number being saved to the cart session before the checkout guard's guess limit was checked. This makes it possible for unauthenticated attackers to keep guessing gift card numbers after the limit is reached, and a correct guess still applies the card's balance to their order, which the returned totals reveal.

## References

- https://wpsec.com/vuln/WPSEC-2026-2159/
- https://plugins.svn.wordpress.org/wp-easycart/tags/6.0.6/
- https://wordpress.org/plugins/wp-easycart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2159/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.