CVE-2024-11423: Wp Swings Gift Cards For Woocommerce Pro

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints such as /wp-json/gifting/recharge-giftcard in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to recharge a gift card balance, without making a payment along with reducing gift card balances without purchasing anything.

Affected products

• Wp Swings Gift Cards For Woocommerce Pro: up to and including 2.9.1
• Wpswings Ultimate Gift Cards For Woocommerce: up to and including 3.0.6

Published 2025-01-08. Last modified 2026-06-17.