Information disclosure in Ultimate Gift Cards For Woocommerce
CVE-2026-19439
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.
Vulnerability class: Information Disclosure
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Unknown Ultimate Gift Cards For Woocommerce
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-19439?
- CVE-2026-19439 is a high-severity vulnerability in Ultimate Gift Cards For Woocommerce, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-09-10.
- How severe is CVE-2026-19439?
- High severity. CVSS v3 base score is 7.5 out of 10.