[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpGLZ0zMG3U-aPTgk9W-BiBMqp1Dl3c3fYpm768mTrek":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57412","gift-cards-gift-vouchers-and-packages-woocommerce-supported-missing-authorization","Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) \u003C= 4.6.9 - Missing Authorization","The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.6.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.","gift-voucher",null,"\u003C=4.6.9","4.7.0","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-08 00:00:00","2026-07-14 19:26:03",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7a5dc4c8-9402-4003-8fa6-b2b98a868024?source=api-prod",7,[22,23,24,25,26,27,28,29],"admin.php","gift-voucher.php","include\u002Fpdf-wrapper.php","include\u002Fvoucher-shortcodes.php","include\u002Fvoucher_metabox.php","include\u002Fvoucher_settings.php","include\u002Fwpgv-product-settings.php","include\u002Fwpgv_giftcard_pdf.php","researched",false,3,"nopriv_` for logged-out users.\n    Since there is no `nopriv` registration, this is not an unauthenticated leak.\n\n    So we are back to the AJAX handlers or shortcodes.\n    The `wpgv_voucher_successful_shortcode` is definitely a \"Missing Authorization\" on an action (marking a voucher as paid).\n    Let's focus on that as it's a very clear \"Unauthorized Action\".\n\n    One problem: How do we get a `voucheritem` ID?\n    If we can't create one via AJAX, we can just guess? They are sequential IDs.\n    Or we can use the \"Check Voucher Balance\" shortcode to find IDs?\n    `echo do_shortcode(' [wpgv-check-voucher-balance] ');`\n    Actually, let's stick to the AJAX voucher creation.\n\n    Final check on `wpgv_doajax_gift_card_pdf_save`:\n    The function `wpgv__doajax_gift_card_pdf_save_func` is definitely the target for the \"Missing Authorization\" on function.\n    The `nopriv` registration is inferred, but highly likely for a gift card plugin purchase flow.\n\n    1.  Create a \"Success\" page with `[wpgv-voucher-successful]`.\n    2.  Find\u002FCreate a \"Gift Card\" page with a form to get the nonce `wpgv_giftitems_form_verify`.\n        *Note*:","The Gift Cards plugin for WordPress fails to implement proper authorization checks in its 'payment successful' shortcode and gift card saving AJAX handlers. This allows unauthenticated attackers to mark gift card orders as 'Paid' without completing payment or to create unauthorized voucher entries by manipulating request parameters within a one-hour window of order creation.","\u002F\u002F include\u002Fvoucher-shortcodes.php line 8\nfunction wpgv_voucher_successful_shortcode()\n{\n\tglobal $wpdb;\n\t$return = '';\n\n\t$voucher_table \t= $wpdb->prefix . 'giftvouchers_list';\n\t\u002F\u002F ... (omitted code)\n\tif (isset($_GET['voucheritem'])) {\n\t\t$voucheritem = absint($_GET['voucheritem']);\n\t\t$voucher_options = $wpdb->get_row(\n\t\t\t$wpdb->prepare(\"SELECT * FROM $voucher_table WHERE id = %d\", $voucheritem)\n\t\t);\n\t\t$check_send_mail = $voucher_options->check_send_mail;\n\n\t\tif ((strtotime($voucher_options->voucheradd_time) + 3600) \u003C strtotime(current_time('mysql'))) {\n\t\t\treturn '\u003Cdiv class=\"error\">\u003Cp>' . esc_html_e('This URL is invalid. You can not access this page directly.', 'gift-voucher') . '\u003C\u002Fp>\u003C\u002Fdiv>';\n\t\t}\n\n\t\t\u002F\u002F ... (omitted code)\n\n\t\t\tif ($voucherrow) {\n\t\t\t\t$wpdb->update(\n\t\t\t\t\t$voucher_table,\n\t\t\t\t\tarray(\n\t\t\t\t\t\t'payment_status' \t=> 'Paid',\n\t\t\t\t\t\t'voucheradd_time'\t=> current_time('mysql')\n\t\t\t\t\t),\n\t\t\t\t\tarray('id' => $voucheritem),\n\t\t\t\t\tarray(\n\t\t\t\t\t\t'%s'\n\t\t\t\t\t),\n\t\t\t\t\tarray('%d')\n\t\t\t\t);\n\n---\n\n\u002F\u002F include\u002Fwpgv_giftcard_pdf.php line 8\nfunction wpgv__doajax_gift_card_pdf_save_func()\n{\n\n\t\u002F\u002F phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized\n\tif (! isset($_POST['nonce']) || ! ! wp_verify_nonce(wp_unslash($_POST['nonce']), 'wpgv_giftitems_form_verify')) {\n\t\twp_send_json_error(array('message' => 'Invalid security token'));\n\t\twp_die();\n\t}\n\n\tglobal $wpdb;\n\t$voucher_table \t= $wpdb->prefix . 'giftvouchers_list';\n    \u002F\u002F ... (processes input and performs $wpdb->insert without capability check)","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgift-voucher\u002F4.6.9\u002Fadmin.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgift-voucher\u002F4.7.0\u002Fadmin.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgift-voucher\u002F4.6.9\u002Fadmin.php\t2026-03-24 03:43:22.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgift-voucher\u002F4.7.0\u002Fadmin.php\t2026-05-15 03:40:58.000000000 +0000\n@@ -2,6 +2,80 @@\n \n if (!defined('ABSPATH')) exit;  \u002F\u002F Exit if accessed directly\n \n+if (!function_exists('wpgv_is_plugin_admin_screen')) {\n+\t\u002F**\n+\t * Check whether the current admin request belongs to this plugin's own screens.\n+\t *\n+\t * @param WP_Screen|null $screen Optional screen object.\n+\t * @return bool\n+\t *\u002F\n+\tfunction wpgv_is_plugin_admin_screen($screen = null)\n+\t{\n+\t\tif (!is_admin()) {\n+\t\t\treturn false;\n+\t\t}\n+\n+\t\tif (null === $screen && function_exists('get_current_screen')) {\n+\t\t\t$screen = get_current_screen();\n+\t\t}\n+\n+\t\t$current_page = isset($_GET['page']) ? sanitize_key(wp_unslash($_GET['page'])) : '';\n+\t\t$current_post_type = isset($_GET['post_type']) ? sanitize_key(wp_unslash($_GET['post_type'])) : '';\n+\t\t$current_taxonomy = isset($_GET['taxonomy']) ? sanitize_key(wp_unslash($_GET['taxonomy'])) : '';\n+\n+\t\t$allowed_pages = array(\n+\t\t\t'wpgv-gift-cards',\n+\t\t\t'voucher-templates',\n+\t\t\t'new-voucher-template',\n+\t\t\t'view-voucher-details',\n+\t\t\t'voucher-setting',\n+\t\t\t'vouchers-lists',\n+\t\t);\n+\t\t$allowed_post_types = array(\n+\t\t\t'voucher_template',\n+\t\t\t'wpgv_voucher_product',\n+\t\t);\n+\t\t$allowed_taxonomies = array(\n+\t\t\t'wpgv_voucher_category',\n+\t\t\t'category_voucher_template',\n+\t\t);\n+\n+\t\tif ($current_page && in_array($current_page, $allowed_pages, true)) {\n+\t\t\treturn true;\n+\t\t}\n+\n+\t\tif ($current_post_type && in_array($current_post_type, $allowed_post_types, true)) {\n+\t\t\treturn true;\n+\t\t}\n+\n+\t\tif ($current_taxonomy && in_array($current_taxonomy, $allowed_taxonomies, true)) {\n+\t\t\treturn true;\n+\t\t}\n+\n+\t\tif (!$screen) {\n+\t\t\treturn false;\n+\t\t}\n+\n+\t\tif (!empty($screen->post_type) && in_array($screen->post_type, $allowed_post_types, true)) {\n+\t\t\treturn true;\n+\t\t}\n+\n+\t\tif (!empty($screen->taxonomy) && in_array($screen->taxonomy, $allowed_taxonomies, true)) {\n+\t\t\treturn true;\n+\t\t}\n+\n+\t\tif (!empty($screen->id)) {\n+\t\t\tforeach ($allowed_pages as $allowed_page) {\n+\t\t\t\tif (false !== strpos($screen->id, $allowed_page)) {\n+\t\t\t\t\treturn true;\n+\t\t\t\t}\n+\t\t\t}\n+\t\t}\n+\n+\t\treturn false;\n+\t}\n+}\n+","The exploit targets the missing authorization in the `wpgv_voucher_successful_shortcode` function. An attacker first identifies or generates a pending gift card order (voucher item ID). They then navigate to the page containing the `[wpgv-voucher-successful]` shortcode, appending the `voucheritem` parameter with the targeted ID (e.g., `?voucheritem=123`). As long as the request is made within 3600 seconds of the voucher's creation, the plugin will update the `payment_status` to 'Paid' in the database without verifying if the current user is an admin or the legitimate payer. This results in the gift card being activated and potentially sent to a recipient without actual financial transaction completion.","gemini-3-flash-preview","2026-07-16 15:32:32","2026-07-16 15:33:25",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","4.6.9","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgift-voucher\u002Ftags\u002F4.6.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgift-voucher.4.6.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgift-voucher\u002Ftags\u002F4.7.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgift-voucher.4.7.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgift-voucher\u002Ftags"]