Data Modification Vulnerability in WooCommerce Gift Cards Plugin

CVE-2024-13520

What is CVE-2024-13520?

The Gift Cards (Gift Vouchers and Packages) plugin for WordPress is susceptible to unauthorized data modifications due to inadequate capability checks in critical functions. Specifically, functions like 'update_voucher_price', 'update_voucher_date', and 'update_voucher_note' lack proper authentication measures, enabling unauthenticated attackers to alter gift voucher details. This vulnerability affects all versions up to and including 4.4.6, allowing potential exploitation that could lead to data loss or unauthorized changes in voucher values and expiration settings.

References