CVE-2026-19436CWE-284broken-access-control

CVE-2026-19436

High · published September 10, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
10.4
In the wild
Unconfirmed
What it is

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00208 · 10.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-09-10T11:17Z
References (1)
https://wpscan.com/vulnerability/7c2f56f6-9c0a-4de2-9cd2-9c25a25c3530/ · [email protected]
EPSS history
Timeline
  • 11 SEP 03:17Z
    EPSS moved — → 0%
    epss
  • 10 SEP 06:00Z
    Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase
    cvelistv5