CVE-2026-19439CWE-200information-disclosure

CVE-2026-19439

High · published September 10, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
16.3
In the wild
Unconfirmed
What it is

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend.

Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00256 · 16.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-10T11:17Z
References (1)
https://wpscan.com/vulnerability/daefdabe-2277-4753-9df5-581134540000/ · [email protected]
EPSS history
Timeline
  • 11 SEP 03:17Z
    EPSS moved — → 0%
    epss
  • 10 SEP 06:00Z
    Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details
    cvelistv5