Missing Authorization in Gift Vouchers Plugin

Executive Summary

CVE-2026-57412 is a Broken Access Control vulnerability in the WordPress Gift Vouchers Plugin versions 4.6.9 and below. It occurs because of missing authorization checks, allowing unauthenticated users to perform actions that normally require higher privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by unauthenticated users to perform unauthorized actions on websites using the affected plugin. Although classified as low severity with a CVSS score of 6.5, it could be used in mass campaigns targeting thousands of websites, potentially leading to unauthorized modifications or disruptions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects WordPress sites using the Gift Vouchers Plugin version 4.6.9 or below and involves broken access control allowing unauthenticated privilege escalation.

To detect if your system is vulnerable, first identify if the Gift Vouchers Plugin is installed and its version is 4.6.9 or lower.

You can check the plugin version on your WordPress site by running the following command in the WordPress root directory:

• wp plugin list | grep gift-voucher

Alternatively, you can look for the plugin version in the plugin's main PHP file or via the WordPress admin dashboard.

To detect exploitation attempts on your network, monitor for unusual HTTP requests targeting the Gift Vouchers Plugin endpoints that might attempt unauthorized actions.

Since the vulnerability allows unauthenticated users to perform privileged actions, look for suspicious POST or GET requests to the plugin's URLs without proper authentication.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation step is to update the Gift Vouchers Plugin to version 4.7.0 or later, where this vulnerability is patched.

If updating immediately is not possible, restrict access to the plugin's endpoints by implementing proper access controls at the web server or application level.

Users of Patchstack can enable auto-updates for vulnerable plugins to ensure timely patching.

Additionally, consult with your hosting provider or developer for assistance in applying the patch or mitigating the risk.

Useful 0 Not Useful 0