Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2024-11423 EUVD-2024-34182GHSA-27hg-cw87-7chh

Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch

Published Jan 8, 2025 · Updated May 20, 2026 · Assigned by Wordfence

Vendor: WP Swings Product: Gift Cards For WooCommerce Pro Product: Ultimate Gift Cards For WooCommerce Category: Web / CMS

Description

The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints such as /wp-json/gifting/recharge-giftcard in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to recharge a gift card balance, without making a payment along with reducing gift card balances without purchasing anything.

Affected products

VendorProductAffectedFixed
WP Swings Gift Cards for WooCommerce Pro ≤ 2.9.1 —
wpswings Ultimate Gift Cards for WooCommerce ≤ 3.0.6 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • RandomRobbieBF/CVE-2024-11423 ★ 4 · Jan 8, 2025

    Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References