CVE-2024-11423

The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints such as /wp-json/gifting/recharge-giftcard in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to recharge a gift card balance, without making a payment along with reducing gift card balances without purchasing anything.

• CWE-862

• https://plugins.trac.wordpress.org/changeset/3212554/woo-gift-cards-lite/trunk/includes/giftcard-redeem-api-addon.php
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208474%40woo-gift-cards-lite&new=3208474%40woo-gift-cards-lite&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/836884b5-f547-4f50-8a97-5d910d877e5e?source=cve

Published

Jan 8, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11418The Additional Order Filters for WooCommerce plugin for Word…6.1
• CVE-2024-11419The Password for WP plugin for WordPress is vulnerable to Cr…6.1
• CVE-2024-1142Path Traversal in Sonatype IQ Server from version 143 allows…5.4
• CVE-2024-11420The Blocksy theme for WordPress is vulnerable to Stored Cros…5.4
• CVE-2024-11421Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-11422A maliciously crafted DWFX file, when parsed through Autodes…7.8
• CVE-2024-11424The Slick Sitemap plugin for WordPress is vulnerable to Stor…6.4
• CVE-2024-11425CWE-131: Incorrect Calculation of Buffer Size vulnerability …8.7
• CVE-2024-11426The AutoListicle: Automatically Update Numbered List Article…6.4
• CVE-2024-11427The Catch Popup plugin for WordPress is vulnerable to Stored…6.4
• CVE-2024-11428The Lazy load videos and sticky control plugin for WordPress…6.4
• CVE-2024-11429The Free Responsive Testimonials, Social Proof Reviews, and …8.8