Security readout for executives and security teams
Plain-English summary
This flaw lets an attacker trick a logged-in WordPress administrator into changing gift card product settings for a WooCommerce store. It requires administrator interaction, so it is not a self-running compromise, but it can affect store integrity and customer-facing gift card behavior.
Executive priority
Treat as a moderate e-commerce integrity issue. Remediate during the next maintenance window, sooner for stores with active gift card sales or many administrators.
Technical view
Ultimate Gift Cards for WooCommerce through 2.1.1 lacks proper nonce validation in mwb_wgm_save_post(), creating a CWE-352 CSRF issue. An unauthenticated attacker can cause an administrator’s browser to submit unauthorized product gift card detail changes. CVSS 3.1 is 4.3 with low integrity impact only.
Likely exposure
Exposure is limited to WordPress/WooCommerce sites running Ultimate Gift Cards for WooCommerce version 2.1.1 or earlier. Risk is higher where administrators remain logged into wp-admin while opening untrusted links or messages.
Exploitation context
The provided bundle does not show CISA KEV listing or active exploitation evidence. Abuse requires social engineering a site administrator into performing an action such as clicking a link while authenticated.
Researcher notes
The strongest evidence is the CVE description and Wordfence/NinTechNet references. The affected metadata in the bundle is sparse, but the narrative identifies versions through 2.1.1 and a 2.1.2 source reference suggests the relevant code area.
Mitigation direction
- Upgrade Ultimate Gift Cards for WooCommerce to a release newer than 2.1.1.
- Confirm vendor guidance and plugin changelog before closing remediation.
- Restrict administrator browsing from authenticated WordPress sessions.
- Review gift card product settings for unauthorized changes.
- Ensure administrators use separate browsers or profiles for wp-admin work.
Validation and detection
- Inventory all WordPress sites for the plugin and exact version.
- Confirm no installed instance is version 2.1.1 or earlier.
- Review gift card product change history for unexpected edits.
- Verify the save handler uses nonce validation after updating.
- Check whether affected administrators reported suspicious links or prompts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-4391 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2da322ea-0206-4838-8ac4-9dd201bb00bc?source=cveCVE reference
- https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/CVE reference
- https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/CVE reference
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/CVE reference
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/CVE reference
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/CVE reference
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/CVE reference
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/CVE reference
- https://plugins.trac.wordpress.org/browser/woo-gift-cards-lite/tags/2.1.2/admin/class-woocommerce-gift-cards-lite-admin.php?rev=2549904#L461CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.