CVE-2026-15039

Deferred Deferred - Pending Action

Unauthenticated File Upload RCE in Giftware WordPress Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-15039

EUVD

EUVD-2026-57082

Affected Vendors & Products

Vendor	Product	Version / Range
gift_cards_for_woocommerce_pro	4.2.10	to 4.2.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Gift Cards For WooCommerce Pro WordPress plugin before version 4.2.10. It allows unauthenticated users to upload any file type, including malicious PHP code, to the server through an unprotected upload path. This could lead to remote code execution on the affected website.

Detection Guidance

Check if the Gift Cards For WooCommerce Pro plugin version is below 4.2.10. Look for unexpected files in upload directories, especially PHP files in paths meant for static assets. Review server logs for upload attempts to unprotected paths.

Impact Analysis

An attacker could exploit this to upload and execute arbitrary code on your server, potentially taking full control of your website. This could lead to data theft, defacement, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update the Gift Cards For WooCommerce Pro plugin to version 4.2.10 or later immediately. Remove any unauthorized files, especially PHP scripts, from upload directories. Restrict write permissions to upload paths and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-15039. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70