Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access… (CVE-2026-103357)

The VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo plugin contains a missing authorization vulnerability (CWE-862) in versions up to 1.1.3. This vulnerability arises from incorrectly configured access control security levels, allowing unauthorized users to exploit the system. The issue is publicly documented as CVE-2026-103357. There is no vendor advisory or patch information provided, and no known active exploitation has been reported.

The vulnerability could allow unauthorized users to perform actions that should require authorization, potentially leading to unauthorized access or modification of gift card functionalities within the affected plugin. The exact impact depends on the specific access controls misconfigured but generally represents a medium risk due to the potential for privilege escalation or unauthorized operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations for the affected plugin to limit unauthorized access. Monitor vendor channels for updates or patches addressing this vulnerability.