WPScan published three September disclosures about Ultimate Gift Cards for WooCommerce, identifying weaknesses affecting issued value, customer information and the right to redeem a card.
Technical severity and the conditions behind the scores
WPScan rates unauthorized redemption at 6.5, or medium severity, and both value inflation and information disclosure at 7.5, or high severity. The official records contain matching CVSS v3.1 assessments from CISA. These scores describe intrinsic technical characteristics, rather than evidence of retailer losses or attacks in progress. [S01] [S02] [S03] [S05] [S06] [S07]
Published CVSS v3.1 base scores for the three gift-card vulnerabilities
The scores in WPScan’s disclosures agree with the CISA assessments in the official CVE records, checked October 19, 2026.
CVSS v3.1 points (0–10)
Tap or hover for details. All values are also available in the data table.
Sources
Base severity scores are not attack probabilities, loss estimates, numbers of affected stores or incident counts. A 7.5 score does not establish a proportional increase in harm over 6.5. Site configuration, companion plugins and access conditions matter; no exploitation was attempted.
Show data tableHide data table
| Category | CVSS v3.1 base score |
|---|---|
| CVE-2026-75861: unauthorized redemption | 6.5 CVSS v3.1 points (0–10) |
| CVE-2026-19436: gift-card value inflation | 7.5 CVSS v3.1 points (0–10) |
| CVE-2026-19439: details and code disclosure | 7.5 CVSS v3.1 points (0–10) |
The first advisory, published September 7 [S01], concerns missing recipient checks. It says an authenticated user could redeem another person's card through affected integrations with companion plugins. One path had already received an ownership check in version 3.2.9, while another remained affected.
A September 8 disclosure [S02] describes a separate failure to reconcile issued gift-card value with the amount collected at checkout, allowing excess store credit to be created.
The third advisory, also dated September 8 [S03], covers access to gift-card details without authorisation. WPScan says affected versions exposed personal data, balances and dates; version 3.2.9 also exposed a usable redemption code.
WPScan identifies version 3.2.10 as the fixed release for all three issues. The vendor's WordPress changelog [S04], however, lists the same vulnerability identifiers under version 3.2.11, dated September 7. The sources do not explain that difference.
These are newly published security findings, not evidence that a particular retailer suffered theft. The advisories do not quantify losses or identify affected merchants. The operational concern is specific: gift-card value must remain tied to paid amounts, authorised access and the intended recipient.
The published scoring vectors make the access distinction visible. For CVE-2026-75861, the vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. For CVE-2026-19436, it is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The first assumes low privileges; the second does not require privileges. These assessments concern integrity and do not quantify stolen value. [S05] [S06]
CVE-2026-19439 uses CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting the assessed confidentiality impact. CVSS is owned by FIRST and used by permission. Its base score is one input into a security assessment, not a complete measure of risk for an individual store. [S07] [S08]
The CVE records were published on September 9 and 10, after WPScan’s September 7 and 8 advisory dates. Their affected-version boundaries match WPScan, but do not resolve the different fix version in the vendor changelog. The current WordPress listing shows release 3.2.12 dated September 15; that later listing is distinct from evidence about which earlier release first corrected each flaw. [S04] [S05] [S06] [S07]
In this article
Daniel Brooks
Daniel Brooks covers payment networks, financial technology, payment security, gift card fraud and PCI DSS for Gift Card News.