Unauthorized Data Exposure in Ultimate Gift Cards for WooCommerce Plugin by WordPress
CVE-2026-19439

Currently unrated

Key Information:

Vendor

WordPress
Status
Ultimate Gift Cards For WooCommerce
Vendor
CVE Published:
10 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-19439?

The Ultimate Gift Cards for WooCommerce plugin prior to version 3.2.10 lacks necessary authorization checks, enabling unauthorized users to access sensitive gift card information. This vulnerability permits retrieval of attached gift cards from arbitrary orders, exposing significant customer personal data, including balances and dates. Additionally, in version 3.2.9, the live redemption code is also disclosed, which can be exploited by anyone who possesses it.

Affected Version(s)

Ultimate Gift Cards for WooCommerce 3.0.3 < 3.2.10

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-19439 - Proof of Concept

References

https://wpscan.com/vulnerability/daefdabe-2277-4753-9df5-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Usama Arshad
WPScan
.