CVE-2026-45444: Gift Cards For WooCommerce File Upload Flaw

CVE-2026-45444 Overview

CVE-2026-45444 is an unrestricted file upload vulnerability in the WP Swings Gift Cards For WooCommerce Pro plugin for WordPress. The flaw affects all versions up to and including 4.2.6. An unauthenticated remote attacker can upload files of dangerous types to a vulnerable site, leading to arbitrary code execution on the underlying web server. The issue is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact

Unauthenticated attackers can upload web shells and execute arbitrary code on affected WooCommerce sites, leading to full site compromise.

Affected Products

• WP Swings Gift Cards For WooCommerce Pro plugin for WordPress
• All versions from n/a through 4.2.6
• WordPress sites running WooCommerce with this plugin enabled

Discovery Timeline

• 2026-05-20 - CVE-2026-45444 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-45444

Vulnerability Analysis

The vulnerability resides in the file upload handling logic of the Gift Cards For WooCommerce Pro plugin. The plugin accepts file uploads without enforcing restrictions on file type, extension, or MIME content. An attacker can submit a crafted HTTP request containing a PHP file or other server-executable payload. Once uploaded, the file is stored in a web-accessible location under the WordPress uploads directory.

Because the upload endpoint does not require authentication or privilege checks, any remote actor can reach it. The attack scales to any internet-facing WordPress site running a vulnerable version of the plugin.

Root Cause

The root cause is missing validation of uploaded file content and extensions. The plugin trusts client-supplied filenames and MIME types instead of applying an allowlist of safe extensions, verifying the file signature, and rejecting executable handlers such as .php, .phtml, or .phar. This pattern maps directly to CWE-434.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends a POST request to the vulnerable upload endpoint with a malicious file attached. After upload, the attacker requests the file via its public URL to trigger execution by the PHP interpreter. This yields remote code execution under the web server account, enabling database theft, credential harvesting, and lateral movement.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2026-45444

Indicators of Compromise

• Unexpected files with extensions such as .php, .phtml, .phar, or .htaccess inside wp-content/uploads/ subdirectories created by the Gift Cards plugin.
• POST requests from unauthenticated sources to plugin upload handlers under /wp-content/plugins/giftware/ or the plugin's AJAX endpoints.
• New WordPress administrator accounts or modified wp-config.php timestamps following anomalous upload traffic.
• Outbound connections from the web server to attacker infrastructure shortly after a successful upload request.

Detection Strategies

• Review web server access logs for HTTP 200 responses on POST requests to plugin endpoints followed by GET requests to files in the uploads directory.
• Run file integrity monitoring against the wp-content/uploads/ tree and alert on any file with a PHP-executable extension.
• Inspect WordPress audit logs for unauthenticated file upload activity and unexpected media additions.

Monitoring Recommendations

• Forward web server, PHP-FPM, and WordPress logs to a centralized SIEM for correlation against known WordPress attack patterns.
• Add detections for child processes spawned by the web server user, such as php invoking sh, curl, or wget.
• Monitor for the creation of files matching web shell signatures (eval(, base64_decode(, system($_) within the WordPress document root.

How to Mitigate CVE-2026-45444

Immediate Actions Required

• Update WP Swings Gift Cards For WooCommerce Pro to a version later than 4.2.6 as soon as the vendor publishes a fixed release.
• If no patched release is available, deactivate and remove the plugin from all WordPress installations.
• Audit wp-content/uploads/ for unauthorized PHP files and remove any that are identified.
• Rotate WordPress administrator passwords, API keys, and database credentials if compromise is suspected.

Patch Information

At the time of publication, refer to the Patchstack Vulnerability Report for the latest vendor advisory and patched version information. Apply the vendor-supplied update on all affected sites once released.

Workarounds

• Block public access to the plugin's upload endpoints at the web application firewall (WAF) until a patch is applied.
• Deny execution of PHP files within wp-content/uploads/ using web server configuration.
• Restrict access to the WordPress admin area and plugin endpoints by source IP where feasible.

# Apache: block PHP execution inside the WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}