CVE-2026-75861 Overview
CVE-2026-75861 is a missing authorization vulnerability [CWE-862] in the Ultimate Gift Cards for WooCommerce WordPress plugin before version 3.2.10. The plugin fails to verify that the user redeeming a gift card is the intended recipient. Any authenticated user, including a low-privilege subscriber, can redeem gift cards issued to other users. The attack zeroes the victim's gift card balance and credits the value to the attacker's account. Version 3.2.9 added an ownership check on one of two redemption paths. The remaining vulnerable path requires a companion plugin from the same vendor to be active.
Critical Impact
Authenticated attackers can steal gift card balances belonging to other WooCommerce customers, resulting in monetary loss and integrity impact to store financial records.
Affected Products
- Ultimate Gift Cards for WooCommerce WordPress plugin versions prior to 3.2.10
- WooCommerce stores running the vulnerable plugin with subscriber-level or higher user registration enabled
- Sites where the companion plugin from the same vendor is active alongside the vulnerable redemption path
Discovery Timeline
- 2026-09-09 - CVE-2026-75861 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-75861
Vulnerability Analysis
The vulnerability is a broken access control flaw classified under [CWE-862] Missing Authorization. The plugin exposes gift card redemption endpoints that accept a gift card identifier or code but do not validate the requesting user against the gift card's assigned recipient. An attacker with a subscriber account can invoke the redemption logic against any known or enumerated gift card. The plugin then transfers the balance from the legitimate recipient to the attacker's account.
The issue affects two redemption paths in versions before 3.2.9. Version 3.2.9 introduced an ownership check on one path but left the second unpatched. The remaining path becomes exploitable when a companion plugin from the same vendor is installed and active. Version 3.2.10 addresses both paths.
Root Cause
The root cause is the absence of a server-side check comparing the authenticated user identifier against the gift card recipient identifier before applying the balance transfer. The plugin treats presentation of a gift card reference as sufficient authorization, ignoring recipient assignment metadata stored with the gift card record.
Attack Vector
Exploitation requires network access to the WordPress site and a valid low-privilege account such as a subscriber. Many WooCommerce stores allow open customer registration, which satisfies this prerequisite. The attacker authenticates, then issues a redemption request referencing a target gift card. The server processes the redemption without verifying recipient ownership. See the WPScan Vulnerability Advisory for further technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-75861
Indicators of Compromise
- Gift card balances reduced to zero on accounts belonging to customers who did not initiate a redemption
- Redemption events in the WooCommerce order log where the redeeming user identifier does not match the gift card recipient identifier
- Unexplained increases in wallet or store credit balances on subscriber-level accounts
- Redemption requests originating from user accounts with no prior purchase history
Detection Strategies
- Query the gift card database table to correlate redeemed_by user identifiers against the original recipient user identifiers and flag mismatches
- Review web server access logs for POST requests to gift card redemption endpoints from low-privilege authenticated sessions
- Alert on redemption events that occur immediately after account creation by newly registered subscribers
Monitoring Recommendations
- Enable WordPress audit logging for plugin activity, focusing on gift card redemption actions and wallet credit changes
- Forward WooCommerce and WordPress logs to a centralized SIEM for correlation of account creation, authentication, and redemption events
- Monitor for anomalous spikes in gift card redemption volume that could indicate mass exploitation
How to Mitigate CVE-2026-75861
Immediate Actions Required
- Update the Ultimate Gift Cards for WooCommerce plugin to version 3.2.10 or later on all WordPress installations
- Audit gift card redemption history for the past several months to identify unauthorized redemptions and reimburse affected customers
- Review recently created subscriber accounts and disable or investigate any that performed gift card redemptions
Patch Information
Upgrade to Ultimate Gift Cards for WooCommerce version 3.2.10, which adds ownership verification on both redemption paths. Version 3.2.9 only partially addresses the issue and remains exploitable when the vendor's companion plugin is active. Refer to the WPScan Vulnerability Advisory for patch validation guidance.
Workarounds
- Deactivate the Ultimate Gift Cards for WooCommerce plugin until the patched version can be deployed
- Disable open customer registration on the WooCommerce store to remove the authenticated attacker prerequisite
- Deactivate the vendor's companion plugin to close the second redemption path if immediate upgrade is not possible
- Restrict gift card redemption functionality to specific user roles through WordPress capability management until patching completes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
