CVE-2026-19436: WooCommerce Gift Cards Auth Bypass Flaw

CVE-2026-19436 Overview

CVE-2026-19436 is a business logic flaw in the Ultimate Gift Cards for WooCommerce WordPress plugin in versions prior to 3.2.10. The plugin issues a gift card coupon at checkout without reconciling the coupon face value against the amount the buyer actually paid. Unauthenticated users can exploit the flaw to obtain store credit that exceeds the payment they submitted. The result is direct financial loss for store operators and inflated redeemable balances usable across the storefront.

Critical Impact
Unauthenticated attackers can generate gift card coupons worth more than they paid, converting the WooCommerce store into a source of unearned store credit.

Affected Products

Ultimate Gift Cards for WooCommerce WordPress plugin, all versions prior to 3.2.10
WordPress sites running WooCommerce with the vulnerable plugin enabled
E-commerce deployments that expose gift card purchase workflows to unauthenticated shoppers

Discovery Timeline

2026-09-10 - CVE-2026-19436 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-19436

Vulnerability Analysis

The vulnerability is a business logic error in the gift card issuance workflow. When a shopper purchases a gift card at checkout, the plugin generates a WooCommerce coupon representing the gift card face value. The plugin does not verify that the amount collected by the payment processor matches the requested gift card value before issuing the coupon. An attacker can manipulate checkout inputs so the recorded payment total is lower than the gift card denomination while the coupon is still issued at the higher face value.

The issued coupon functions as normal store credit and can be redeemed against subsequent orders. Because the flaw sits in server-side reconciliation logic rather than payment gateway integration, it affects any payment method that permits price manipulation between cart configuration and order finalization. The vendor addressed the issue in version 3.2.10 by reconciling issued coupon values against captured payment amounts.

Root Cause

The root cause is a missing server-side validation step between coupon generation and payment capture. The plugin trusts the gift card value submitted during the checkout flow rather than deriving redeemable value from the amount actually settled. This is a Business Logic Error rather than a memory or injection defect.

Attack Vector

An unauthenticated user visits a storefront with the vulnerable plugin enabled and initiates a gift card purchase. The attacker manipulates cart totals, coupon stacking, discount interactions, or intercepted checkout parameters so the paid total drops below the gift card face value. The plugin issues the coupon at the requested denomination. Technical details are described in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-19436

Indicators of Compromise

Gift card coupons in the WooCommerce database whose face value exceeds the associated order total.
Orders that completed with a paid total significantly below the sum of gift card line items.
Repeated gift card purchases from the same IP address, email, or fingerprint using discount stacking or price manipulation.
Redemption of newly issued gift card coupons within short windows of the originating order.

Detection Strategies

Query the WooCommerce order and coupon tables for records where issued gift card value is greater than order_total minus fees and taxes.
Correlate gift card coupon creation events with payment gateway settlement reports to flag mismatches.
Alert on checkout requests that modify gift card product prices or apply unexpected discount codes to gift card line items.

Monitoring Recommendations

Enable verbose logging on the WooCommerce checkout and coupon subsystems to capture parameter values submitted by unauthenticated users.
Forward web server, WordPress, and payment gateway logs to a centralized analytics platform for cross-source correlation.
Review daily reports of issued gift card totals against captured revenue to surface reconciliation gaps.

How to Mitigate CVE-2026-19436

Immediate Actions Required

Upgrade the Ultimate Gift Cards for WooCommerce plugin to version 3.2.10 or later on all WordPress sites.
Audit gift card coupons issued before the upgrade and disable any coupons whose face value exceeds the associated captured payment.
Reconcile recent order settlements with issued gift card values and refund or void discrepancies where possible.

Patch Information

The vendor released version 3.2.10 of Ultimate Gift Cards for WooCommerce with server-side reconciliation between coupon face value and captured payment amount. Administrators should apply the update through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily disable the Ultimate Gift Cards for WooCommerce plugin until version 3.2.10 or later is deployed.
Restrict gift card product visibility to authenticated customers to reduce exposure from unauthenticated actors.
Cap the maximum gift card denomination available at checkout to limit potential loss per exploit attempt.

bash

# Configuration example
wp plugin update woo-gift-cards-lite --version=3.2.10
wp plugin deactivate woo-gift-cards-lite  # temporary workaround if patch cannot be applied