CVE-2026-75861 is a missing authorization vulnerability (CWE-862) in the Ultimate Gift Cards for WooCommerce WordPress plugin prior to 3.2.10. The plugin fails to verify that the user redeeming a gift card is the legitimate owner, enabling any authenticated user to redeem gift cards belonging to others. This results in the victim's gift card balance being zeroed and the value credited to the attacker. Version 3.2.9 partially mitigates this by adding an ownership check on one redemption path, but a second redemption path remains vulnerable if a companion plugin from the same vendor, also before 3.2.10, is active.

An attacker with any authenticated user account can redeem gift cards assigned to other users, effectively stealing their gift card balances. This leads to unauthorized financial loss for legitimate users and potential revenue loss for merchants using the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade the Ultimate Gift Cards for WooCommerce plugin and any companion plugins to version 3.2.10 or later once available. Until then, consider restricting authenticated user permissions or disabling the gift card redemption feature if feasible.