CVE-2026-57412: Gift Vouchers Auth Bypass Vulnerability

CVE-2026-57412 Overview

CVE-2026-57412 is a Missing Authorization vulnerability [CWE-862] in the Codemenschen Gift Vouchers plugin (gift-voucher) for WordPress. The flaw stems from incorrectly configured access control security levels on plugin endpoints. Unauthenticated network attackers can reach functionality that should require privileges.

The vulnerability affects all versions from unspecified initial releases through 4.6.9. Successful exploitation impacts integrity and availability of gift voucher data. Attackers do not require user interaction or credentials to trigger the condition.

Critical Impact
Unauthenticated attackers can invoke protected plugin operations across the network, tampering with gift voucher data on affected WordPress sites.

Affected Products

Codemenschen Gift Vouchers plugin for WordPress
Plugin slug gift-voucher versions up to and including 4.6.9
WordPress installations with the plugin activated

Discovery Timeline

2026-07-13 - CVE-2026-57412 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57412

Vulnerability Analysis

The Gift Vouchers plugin exposes actions that lack proper capability or nonce enforcement. Requests reach handler logic without validating the caller's role or intent. This condition is classified as Broken Access Control and maps to [CWE-862] Missing Authorization.

An attacker sends crafted HTTP requests to plugin endpoints from any network position. The plugin executes the requested operation because no authorization check gates the code path. The impact scope is limited to the vulnerable application, but touches both integrity and availability of voucher records.

The EPSS probability of exploitation is 0.242% at the 15.4 percentile as of 2026-07-20. No public proof-of-concept, exploit database entry, or CISA KEV listing exists at the time of publication.

Root Cause

The root cause is a missing authorization control in one or more request handlers within the gift-voucher plugin. WordPress plugins commonly guard privileged actions with current_user_can() capability checks and wp_verify_nonce() for request authenticity. The vulnerable handlers omit these checks, allowing anonymous actors to invoke restricted functionality.

Attack Vector

Exploitation occurs over the network against the target WordPress site. The attacker crafts HTTP requests against the plugin's action endpoints, such as admin-ajax.php actions or REST routes registered by the plugin. Because no privileges are required and no user interaction is needed, automated scanners can identify and abuse vulnerable installations at scale.

No verified public exploitation code is available. Technical details are described in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-57412

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing gift voucher actions from anonymous sessions
Unexpected creation, modification, or deletion of gift voucher records in the WordPress database
Access log entries hitting plugin endpoints without an authenticated session cookie

Detection Strategies

Inventory WordPress installations and identify sites running gift-voucher at version 4.6.9 or earlier
Review web server logs for high-volume requests to gift-voucher plugin routes originating from single source addresses
Correlate database change events on voucher tables with request origins lacking an authenticated user context

Monitoring Recommendations

Deploy a Web Application Firewall (WAF) rule that requires authentication headers on sensitive gift-voucher actions
Alert on newly created administrative or voucher records outside of business change windows
Track file integrity of plugin directories under wp-content/plugins/gift-voucher/ for unauthorized modification

How to Mitigate CVE-2026-57412

Immediate Actions Required

Update the Codemenschen Gift Vouchers plugin to a version later than 4.6.9 once released by the vendor
If no fixed version is available, deactivate and remove the plugin until a patch is published
Audit gift voucher and order records for unauthorized changes since the plugin was installed

Patch Information

The vendor's fix status is tracked in the Patchstack Vulnerability Report. Administrators should monitor the WordPress plugin repository for a release higher than 4.6.9 addressing the Missing Authorization defect and apply it as soon as it is available.

Workarounds

Restrict access to /wp-admin/admin-ajax.php gift voucher actions using WAF rules that enforce authenticated sessions
Limit access to the WordPress admin surface by source IP allowlists where feasible
Disable the plugin on public-facing sites that do not actively require gift voucher functionality

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate gift-voucher
wp plugin status gift-voucher