Ultimate Gift Cards for WooCommerce < 3.2.10 - Unauthenticated Inflated Gift Card Credit Acquisition

The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to 3.2.10. This is due to use of the pre-discount item price (`$original_price`) instead of the actual post-discount line total (`$item->get_total()`) when setting the issued gift card coupon amount, combined with a missing check preventing discount coupons from being applied to gift card products. This makes it possible for unauthenticated attackers to obtain gift card store credit worth more than they actually paid by applying discount coupons to gift card purchases, causing the issued coupon value to reflect the pre-discount product price rather than the actual amount collected.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Ultimate Gift Cards for WooCommerce 3.2.10 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts