CVE-2024-11423highCWE-862

CVE-2024-11423: falha de alta gravidade em wpswings Ultimate Gift Cards for WooCommerce

Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Ultimate Gift Cards for WooCommerce+ Monitorar Gift Cards for WooCommerce Pro

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.8%
The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints such as /wp-json/gifting/recharge-giftcard in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to recharge a gift card balance, without making a payment along with reducing gift card balances without purchasing anything.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
wpswings · Ultimate Gift Cards for WooCommerceWP Swings · Gift Cards for WooCommerce Pro
CVEs relacionadas — wpswings Ultimate Gift Cards for WooCommerce

No mesmo produto, das mais perigosas para as menos.

CVE-2021-4391MEDIUMUltimate Gift Cards for WooCommerce <= 2.1.1 - Cross-Site Request Forgery BypassEPSS 0.5%CVE-2025-5103MEDIUMUltimate Gift Cards for WooCommerce <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post FunctionEPSS 0.4%CVE-2024-1857MEDIUMUltimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates <= 2.6.6 - Missing Authorization to Unauthenticated Information ExposureEPSS 0.3%