CVE-2024-11423
Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints such as /wp-json/gifting/recharge-giftcard in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to recharge a gift card balance, without making a payment along with reducing gift card balances without purchasing anything.
WordPress Ultimate Gift Cards for WooCommerce plugin versions 3.0.6 and below are vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints such as /wp-json/gifting/recharge-giftcard. This makes it possible for unauthenticated attackers to recharge a gift card balance, without making a payment along with reducing gift card balances without purchasing anything.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-11-19 CVE Reserved
- 2025-01-07 CVE Published
- 2025-01-08 CVE Updated
- 2025-01-09 EPSS Updated
- 2025-01-09 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-862: Missing Authorization
CAPEC
References (5)
URL | Date | SRC |
---|---|---|
https://packetstorm.news/files/id/183442 | 2025-01-09 | |
https://github.com/RandomRobbieBF/CVE-2024-11423 | 2025-01-09 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
WP Swings Search vendor "WP Swings" | Gift Cards For WooCommerce Pro Search vendor "WP Swings" for product "Gift Cards For WooCommerce Pro" | <= 2.9.1 Search vendor "WP Swings" for product "Gift Cards For WooCommerce Pro" and version " <= 2.9.1" | en |
Affected
| ||||||
Wpswings Search vendor "Wpswings" | Ultimate Gift Cards For WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, And Use Advance Coupons With Personalized Templates Search vendor "Wpswings" for product "Ultimate Gift Cards For WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, And Use Advance Coupons With Personalized Templates" | <= 3.0.6 Search vendor "Wpswings" for product "Ultimate Gift Cards For WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, And Use Advance Coupons With Personalized Templates" and version " <= 3.0.6" | en |
Affected
|