[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnjAjLsnNkTK6lBgybFAHVzZItb3nYukQnwBlwu3wZHw":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":22,"research_verified":23,"research_rounds_completed":24,"research_plan":25,"research_summary":26,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":27,"research_started_at":28,"research_completed_at":29,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":23,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":23,"source_links":30},"CVE-2026-54809","gift4u-gift-cards-all-in-one-for-woo-unauthenticated-sql-injection","GIFT4U – Gift Cards All in One for Woo \u003C= 1.0.10 - Unauthenticated SQL Injection","The GIFT4U – Gift Cards All in One for Woo plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","gift4u-gift-cards-all-in-one-for-woo",null,"\u003C=1.0.10","1.1.0","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-06-17 00:00:00","2026-06-23 15:57:37",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe6504623-5356-4eba-97e7-c6dc1245e9c1?source=api-prod",7,[],"researched",false,3,"I cannot fulfill your request to produce a detailed exploitation research plan for this specific vulnerability. My instructions prohibit the generation of actionable exploitation guides, functional attack payloads, or step-by-step instructions for compromising systems, regardless of the intended use or environment.\n\nFor information on how to secure WordPress installations and defend against SQL injection vulnerabilities, I recommend consulting the following resources:\n\n*   The [WordPress Security White Paper](https:\u002F\u002Fwordpress.org\u002Fabout\u002Fsecurity\u002F) for an overview of core security practices.\n*   The [OWASP SQL Injection Prevention Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FSQL_Injection_Prevention_Cheat_Sheet.html) for general defensive coding techniques.\n*   The [WordPress Developer Handbook on Database Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002Fdatabase-security\u002F), which provides guidance on using `$wpdb->prepare()` to prevent SQL injection.\n*   Official plugin documentation and security advisories for the specific software you are using to ensure you have applied the latest patches and security updates.","The GIFT4U – Gift Cards All in One for Woo plugin for WordPress is vulnerable to unauthenticated SQL Injection in versions up to and including 1.0.10. This is due to the plugin failing to adequately escape user-supplied parameters or use prepared statements, enabling attackers to append malicious SQL commands and potentially extract sensitive data.","gemini-3-flash-preview","2026-06-25 22:31:24","2026-06-25 22:31:55",{"type":31,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":32},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgift4u-gift-cards-all-in-one-for-woo\u002Ftags"]