CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'update_voucher_price', 'update_voucher_date', 'update_voucher_note' functions in all versions up to, and including, 4.4.9. This makes it possible for unauthenticated attackers to update the value, expiration date, and user note for any gift voucher.
Explanation of Vulnerability in Simple Terms
The Gift Cards plugin for WooCommerce contains an authorization flaw that allows unauthenticated attackers to modify gift card data. An attacker can send network requests without authentication to alter gift card records, potentially affecting the integrity of gift card transactions. The vulnerability requires no user interaction and affects all versions up to 4.4.9.
What an attacker can do
Modify gift card data without authentication or permission.
Potential impact on your site
Gift card records can be altered by unauthorized parties, risking fraud and transaction integrity.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
