A critical authorization flaw in the Ultimate Gift Cards for WooCommerce plugin enables unauthenticated attackers to harvest sensitive customer information and redeemable gift card codes.

This vulnerability is an information exposure issue resulting from a missing authorization check. Unauthenticated users can query the plugin to access gift card data, including customer personal information and live redemption codes, which permits unauthorized spending of funds.

The exposure of customer personal data and active gift card redemption codes presents a significant risk of financial loss and privacy violations. Given the CVSS score of 7.5, this high severity vulnerability could lead to direct monetary theft and severe damage to customer trust if exploited to drain active gift card balances.

Immediate Action: Update the Ultimate Gift Cards for WooCommerce plugin to version 3.2.10 or later immediately to enforce necessary authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns of requests directed at gift card endpoints, particularly those originating from unauthorized or anonymous user sessions.

Compensating Controls: If immediate patching is not feasible, implement Web Application Firewall rules to block unauthorized access attempts targeting the plugin's gift card retrieval functions.

Public Exploit Available: No

The severity of this vulnerability necessitates immediate attention to prevent financial fraud and unauthorized data access. Administrators must prioritize updating the plugin to version 3.2.10 to close the authorization gap and protect customer assets.