Ultimate Gift Cards for WooCommerce Missing Authorization Vulnerability Allowing Unauthorized Balance Modifications

A vulnerability exists in the Ultimate Gift Cards for WooCommerce plugin, specifically in versions through 3.0.6. The issue arises from several REST API endpoints lacking proper capability checks, which enables unauthenticated users to manipulate gift card balances. Exploitation of this vulnerability allows for recharging gift cards without payment and reducing gift card values without any purchase.

Impact

Exploitation of this vulnerability could lead to unauthorized gift card balance modifications, allowing users to gain credits without payment or reduce balances without making a purchase.

Remediation

Users are advised to update the Ultimate Gift Cards for WooCommerce plugin to version 3.0.7 or later.