CVE-2026-19436: Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase

Q: Who can exploit this issue?

Unauthenticated users can exploit it. The issue affects gift card purchases where the plugin issues a coupon without reconciling its value to the amount collected at checkout.

Q: What is the practical impact?

An attacker can obtain gift card store credit worth more than the amount they paid. This can result in financial loss through inflated coupon balances.

Q: Which versions are affected?

Versions of Ultimate Gift Cards for WooCommerce before 3.2.10 are affected.

Published Sep 10, 2026

Updated

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.

Affected Software

1 affected component

WooCommerce Ultimate Gift Cards for WooCommerce<3.2.10

Event History

Sep 10, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated users can exploit it. The issue affects gift card purchases where the plugin issues a coupon without reconciling its value to the amount collected at checkout.

What is the practical impact?

An attacker can obtain gift card store credit worth more than the amount they paid. This can result in financial loss through inflated coupon balances.

Which versions are affected?

Versions of Ultimate Gift Cards for WooCommerce before 3.2.10 are affected.