CVE-2026-84760: WooCommerce Gift Cards Auth Bypass Flaw

CVE-2026-84760 Overview

CVE-2026-84760 is a broken access control vulnerability in the Ultimate Gift Cards For WooCommerce WordPress plugin. Versions 3.2.9 and earlier expose functionality to unauthenticated network attackers due to missing authorization checks [CWE-862]. The flaw allows remote actors to reach protected plugin capabilities without any credentials or user interaction.

The vulnerability affects WooCommerce storefronts that use the plugin to issue and manage gift cards. Successful exploitation can result in limited disclosure of information handled by the plugin. The issue is tracked by Patchstack and was published to NVD on 2026-09-02.

Critical Impact
Unauthenticated remote attackers can bypass access control on WooCommerce sites running Ultimate Gift Cards For WooCommerce 3.2.9 or earlier, leading to unauthorized read access to plugin functionality.

Affected Products

Ultimate Gift Cards For WooCommerce plugin (slug: woo-gift-cards-lite)
Plugin versions <= 3.2.9
WordPress sites running WooCommerce with the affected plugin installed

Discovery Timeline

2026-09-02 - CVE-2026-84760 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84760

Vulnerability Analysis

The Ultimate Gift Cards For WooCommerce plugin exposes plugin functionality without verifying whether the requester has permission to access it. The weakness is classified as Missing Authorization [CWE-862]. Because the attack vector is network-based and requires no privileges or user interaction, an unauthenticated attacker can invoke the affected endpoints directly over HTTP.

The scope of impact is limited to confidentiality. Integrity and availability of the WooCommerce store are not directly affected by this specific issue. Attackers can retrieve data that should have been restricted, but they cannot modify records or disrupt service through this flaw alone.

Root Cause

The root cause is the absence of a capability or nonce check on one or more plugin request handlers. WordPress plugins typically enforce access control through current_user_can() checks, check_ajax_referer() calls, or REST API permission_callback functions. In vulnerable versions of woo-gift-cards-lite, at least one such handler proceeds to return data without validating the caller.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable plugin endpoint on a target WooCommerce site. No authentication, session, or user interaction is required. The server processes the request and returns plugin-controlled data that should have required an authorized session.

No public proof-of-concept, exploit code, or Exploit-DB entry is available at the time of publication. Refer to the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2026-84760

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to plugin endpoints under /wp-admin/admin-ajax.php with plugin-specific action parameters tied to woo-gift-cards-lite.
Requests to plugin REST routes (for example /wp-json/ namespaces registered by the plugin) from unexpected source IP addresses.
Anomalous spikes in 200-response traffic to gift card plugin URLs originating from a small set of IPs.

Detection Strategies

Inventory WordPress installations and identify sites running woo-gift-cards-lite at version 3.2.9 or earlier.
Enable and review WordPress access logs and web application firewall (WAF) telemetry for unauthenticated access to plugin endpoints.
Correlate outbound scanning behavior against WooCommerce sites with plugin fingerprint patterns.

Monitoring Recommendations

Alert on high-volume requests to admin-ajax actions related to the gift card plugin from unauthenticated sessions.
Monitor for enumeration attempts against /wp-json/ endpoints registered by the plugin.
Track plugin version changes across WordPress fleets to confirm patch adoption.

How to Mitigate CVE-2026-84760

Immediate Actions Required

Update Ultimate Gift Cards For WooCommerce to a version later than 3.2.9 as soon as the vendor releases a patched build.
Audit WordPress logs for prior unauthenticated access to plugin endpoints to determine potential exposure.
Restrict administrative and plugin endpoints behind a WAF policy that enforces authentication for sensitive routes.

Patch Information

Consult the Patchstack Vulnerability Report for the current fixed version and remediation guidance. Apply the vendor-supplied update through the WordPress plugin manager or WP-CLI once available.

Workarounds

Deactivate the Ultimate Gift Cards For WooCommerce plugin until a patched version is installed.
Deploy virtual patching rules in a WAF (such as Patchstack, Wordfence, or a cloud WAF) to block unauthenticated requests to plugin endpoints.
Limit access to /wp-admin/admin-ajax.php and plugin REST routes by IP allow-listing where the site model permits.

bash

# Update the plugin using WP-CLI once a fixed release is available
wp plugin update woo-gift-cards-lite
wp plugin list --name=woo-gift-cards-lite --fields=name,status,version