The Ultimate Gift Cards for WooCommerce plugin for WordPress suffers from a missing authorization check (CWE-862) in the wps_wgm_preview_email_template() function. This flaw allows unauthenticated remote attackers to read sensitive information by accessing password protected and draft posts through the plugin's preview email template functionality. The vulnerability affects all versions up to and including 2.6.6. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges required, resulting in confidentiality loss only.

An attacker can gain unauthorized read access to sensitive content stored as password protected or draft posts within the WordPress site using the vulnerable plugin. This exposure could lead to leakage of confidential data contained in these posts. There is no impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin functionality or disabling the plugin if feasible to prevent unauthorized information disclosure.