CVE-2024-11423: CWE-862 Missing Authorization in WP Swings Gift Cards for WooCommerce Pro
The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints such as /wp-json/gifting/recharge-giftcard in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to recharge a gift card balance, without making a payment along with reducing gift card balances without purchasing anything.
AI Analysis
Technical Summary
The Ultimate Gift Cards for WooCommerce Pro plugin for WordPress suffers from a missing capability check (CWE-862) on REST API endpoints such as /wp-json/gifting/recharge-giftcard in all versions up to 3.0.6. This lack of authorization validation permits unauthenticated attackers to recharge gift card balances or reduce them without making any payment, effectively allowing unauthorized manipulation of gift card values. The vulnerability has a CVSS 3.1 base score of 7.5 (High), reflecting its network attack vector, low attack complexity, no privileges required, no user interaction, and impact on integrity without affecting confidentiality or availability.
Potential Impact
An attacker can exploit this vulnerability to alter gift card balances without authorization, potentially leading to financial fraud or abuse of the gift card system. The integrity of gift card data is compromised, but confidentiality and availability are not impacted. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the WP Swings vendor advisories for updates and apply any official patches once released. Until a fix is available, consider restricting access to the affected REST API endpoints or disabling the plugin if feasible to prevent exploitation.
CVE-2024-11423: CWE-862 Missing Authorization in WP Swings Gift Cards for WooCommerce Pro
Description
The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints such as /wp-json/gifting/recharge-giftcard in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to recharge a gift card balance, without making a payment along with reducing gift card balances without purchasing anything.
CVSS v3.1
Score 7.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Ultimate Gift Cards for WooCommerce Pro plugin for WordPress suffers from a missing capability check (CWE-862) on REST API endpoints such as /wp-json/gifting/recharge-giftcard in all versions up to 3.0.6. This lack of authorization validation permits unauthenticated attackers to recharge gift card balances or reduce them without making any payment, effectively allowing unauthorized manipulation of gift card values. The vulnerability has a CVSS 3.1 base score of 7.5 (High), reflecting its network attack vector, low attack complexity, no privileges required, no user interaction, and impact on integrity without affecting confidentiality or availability.
Potential Impact
An attacker can exploit this vulnerability to alter gift card balances without authorization, potentially leading to financial fraud or abuse of the gift card system. The integrity of gift card data is compromised, but confidentiality and availability are not impacted. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the WP Swings vendor advisories for updates and apply any official patches once released. Until a fix is available, consider restricting access to the affected REST API endpoints or disabling the plugin if feasible to prevent exploitation.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-11-19T15:07:15.819Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6e13b7ef31ef0b594c0f
Added to database: 2/25/2026, 9:48:03 PM
Last enriched: 5/20/2026, 5:55:09 PM
Last updated: 5/27/2026, 9:04:25 PM
Views: 36
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.