Executive brief
Ultimate Gift Cards for WooCommerce is a WordPress plugin that manages digital gift cards for online stores. The plugin fails to verify that a user redeeming a gift card is the intended recipient, allowing any logged-in subscriber to steal and drain gift cards belonging to other customers. An attacker can redeem any gift card code to credit its full value to themselves, destroying the victim's card balance.
Technical details
The vulnerability is a broken access control flaw (CWE-862) in the gift card redemption functionality. The plugin exposes two redemption endpoints (redeem_gift_card_coupon and wps_recharge_wallet_via_giftcard) that fail to verify recipient ownership before crediting the gift card value. Route A (3.2.9+) requires WooCommerce Points and Rewards plugin to be active; Route B (3.2.8 and earlier) required Wallet System for WooCommerce. Both routes accept only a valid nonce and gift card code, with no owner check. An authenticated attacker with subscriber privileges can extract nonces from public pages and POST to the AJAX endpoints to redeem cards belonging to other users. The vulnerability was partially patched in 3.2.9 (closing Route B) and fully patched in 3.2.10.
Affected products
- WP Smart Shop Ultimate Gift Cards for WooCommerce before 3.2.10
Timeline
- 2026-09-07: disclosed
- 2026-09-09: patched: Version 3.2.10 released