CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the wps_wgm_preview_email_template(). This makes it possible for unauthenticated attackers to read password protected and draft posts that may contain sensitive data.
Explanation of Vulnerability in Simple Terms
The Ultimate Gift Cards for WooCommerce plugin through version 2.6.6 lacks proper authorization checks, allowing unauthenticated attackers to read sensitive data. An attacker can access information without logging in or requiring user interaction. This affects all installations running the vulnerable version.
What an attacker can do
Read sensitive data from the site without authentication.
Potential impact on your site
Unauthenticated visitors can access sensitive information exposed by the plugin.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
