CVE-2024-13520 is a missing authorization vulnerability (CWE-862) in the codemenschen Gift Cards (Gift Vouchers and Packages) plugin for WordPress (WooCommerce Supported). The issue arises because the plugin does not perform capability checks on the 'update_voucher_price', 'update_voucher_date', and 'update_voucher_note' functions. This allows unauthenticated attackers to update the value, expiration date, and user note of any gift voucher, potentially leading to unauthorized modification or loss of data. The vulnerability affects all versions up to 4.4.9. The CVSS 3.1 base score is 5.3, indicating medium severity. No patch or remediation details are currently available.

An unauthenticated attacker can modify gift voucher data including price, expiration date, and notes without authorization. This could lead to unauthorized changes in voucher values and validity, potentially causing financial discrepancies or loss of trust in the voucher system. There is no indication of confidentiality or availability impact. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's endpoints where possible and monitor for unusual voucher modifications. Avoid exposing the plugin's update functions to unauthenticated users. Follow vendor updates closely for an official patch or temporary mitigation.