CVE-2024-13520: The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to…

PriorityP429medium5.3CVSS 3.1

AVNACLPRNUINSUCNILAN

EPSS

0.29%

20.6th percentile

The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'update_voucher_price', 'update_voucher_date', 'update_voucher_note' functions in all versions up to, and including, 4.4.9. This makes it possible for unauthenticated attackers to update the value, expiration date, and user note for any gift voucher.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
codemenschen	gift_cards	<= 4.4.9	—
codemenschen	gift_vouchers	<= 4.4.6	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.