CVE-2024-11423: WooCommerce Gift Cards Auth Bypass Flaw

CVE-2024-11423 Overview

CVE-2024-11423 affects the Ultimate Gift Cards for WooCommerce plugin for WordPress. The plugin exposes several REST API endpoints, including /wp-json/gifting/recharge-giftcard, without a capability check. Unauthenticated attackers can recharge a gift card balance without payment or reduce balances without purchasing anything. The flaw exists in all versions up to and including 3.0.6. The weakness is classified as Missing Authorization [CWE-862] and represents a Broken Access Control issue affecting business logic on the merchant's store.

Critical Impact
Unauthenticated attackers can modify gift card balances over the network, enabling financial fraud against WooCommerce merchants running the affected plugin.

Affected Products

Ultimate Gift Cards for WooCommerce (woo-gift-cards-lite) plugin for WordPress
All plugin versions up to and including 3.0.6
WordPress sites running WooCommerce with the vulnerable plugin enabled

Discovery Timeline

2025-01-08 - CVE-2024-11423 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-11423

Vulnerability Analysis

The plugin registers REST API routes that handle gift card operations, including recharge and redemption flows. These routes lack a permission_callback that validates the requester's capabilities. Any anonymous HTTP client can invoke the endpoints and trigger state-changing operations on gift card records.

The vulnerability is an authorization flaw, not an authentication flaw. The REST controller accepts the request and processes it without verifying the caller has permission to manage gift cards. Attackers can inflate a card balance to use as store credit or zero out balances belonging to legitimate customers.

Root Cause

The root cause is a missing capability check on REST API endpoints registered by the plugin in includes/giftcard-redeem-api-addon.php. WordPress requires developers to supply a permission_callback argument when calling register_rest_route(). The vulnerable code paths either omit this callback or return true unconditionally, granting public access to privileged operations.

Attack Vector

Exploitation requires only network access to the target site. An attacker sends a crafted HTTP request to the vulnerable REST endpoint, such as /wp-json/gifting/recharge-giftcard, with parameters identifying a target gift card and a new balance. No authentication, user interaction, or prior knowledge of the site beyond the public endpoint path is required. The server processes the request and updates the gift card record. Refer to the Wordfence Vulnerability Report for additional context.

Detection Methods for CVE-2024-11423

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-json/gifting/recharge-giftcard or related /wp-json/gifting/ endpoints in web server access logs.
Gift card balance changes in WooCommerce records that do not correspond to a matching order, payment, or admin action.
Sudden spikes in successful gift card redemptions without preceding purchase activity.

Detection Strategies

Audit WordPress site logs for REST API calls to the gifting namespace from unauthenticated sessions or unfamiliar IP addresses.
Correlate gift card balance modifications with WooCommerce order and payment tables to identify unbacked changes.
Deploy a web application firewall rule that flags or blocks requests to vulnerable plugin endpoints lacking an authenticated session cookie.

Monitoring Recommendations

Enable verbose access logging on /wp-json/ traffic and forward logs to a centralized analytics or SIEM platform.
Monitor the plugin version installed across managed WordPress instances and alert when version 3.0.6 or earlier is detected.
Track gift card transaction volume baselines and alert on statistical anomalies in recharge or redemption activity.

How to Mitigate CVE-2024-11423

Immediate Actions Required

Update the Ultimate Gift Cards for WooCommerce plugin to a version newer than 3.0.6 that includes the fix referenced in changeset 3212554.
Review gift card transaction history for unauthorized balance changes and reconcile against payment records.
Restrict access to /wp-json/gifting/ endpoints at the reverse proxy or WAF layer until the patch is verified in place.

Patch Information

The vendor addressed the issue by adding capability checks to the affected REST routes. The change is recorded in the WordPress Plugin Change Log and the broader WordPress Plugin Code Changes. Site administrators should upgrade to the latest plugin release available from the WordPress.org plugin repository.

Workarounds

Disable the Ultimate Gift Cards for WooCommerce plugin until an upgrade can be applied.
Block external requests to /wp-json/gifting/* paths using web server rewrite rules, reverse proxy ACLs, or a WAF policy.
Require authentication at the network edge for all /wp-json/ traffic on sites that do not need anonymous REST access.

bash

# Example nginx configuration to block unauthenticated access
# to the vulnerable plugin REST namespace until patched
location ~ ^/wp-json/gifting/ {
    deny all;
    return 403;
}