Security readout for executives and security teams
Plain-English summary
This flaw lets unauthenticated outsiders change WooCommerce gift-card balances on affected WordPress sites. In business terms, attackers could create store credit without payment or reduce legitimate balances, causing direct financial loss, customer disputes, and accounting cleanup.
Executive priority
Treat as urgent for any store using this plugin because the vulnerability targets money-like gift-card balances directly. Prioritize patching or disabling before broader cosmetic or low-impact WordPress issues.
Technical view
CVE-2024-11423 is a missing authorization issue in Ultimate Gift Cards for WooCommerce REST API endpoints, including /wp-json/gifting/recharge-giftcard, in versions up to and including 3.0.6. The reported impact is unauthorized gift-card balance recharge or reduction without authentication.
Likely exposure
Exposure is limited to WordPress/WooCommerce sites running the affected WP Swings Ultimate Gift Cards for WooCommerce plugin at version 3.0.6 or earlier. The provided affected-product metadata is inconsistent, so confirm installed plugin slug and version locally.
Exploitation context
The CVSS vector is network-accessible, low complexity, unauthenticated, and no user interaction. The source bundle does not show CISA KEV listing or other evidence of active exploitation, so active exploitation should not be assumed.
Researcher notes
The key weakness is CWE-862: missing authorization on REST actions that change financial state. Sources identify vulnerable versions through 3.0.6 and reference WordPress Trac changesets, but the bundle does not provide complete exploit telemetry or a definitive fixed version statement.
Mitigation direction
- Upgrade the affected plugin to a vendor-fixed version or latest available release.
- If no fixed version is available, disable the plugin until vendor guidance is clear.
- Review vendor, Wordfence, and WordPress plugin changelog guidance before restoring use.
- Reconcile gift-card balances against payments and legitimate order history.
- Monitor REST API access to gift-card endpoints for unusual unauthenticated activity.
Validation and detection
- Inventory all WordPress sites for the affected plugin and version.
- Confirm no installed copy is version 3.0.6 or earlier.
- Check gift-card balance changes for missing payment or order linkage.
- Review web logs for access to gift-card REST endpoints.
- Verify updated endpoints enforce authentication and capability checks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-11423 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N3.93.6WordfenceVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineWordfence
Disclosed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/836884b5-f547-4f50-8a97-5d910d877e5e?source=cveCVE reference, Wordfence
- https://plugins.trac.wordpress.org/changeset/3212554/woo-gift-cards-lite/trunk/includes/giftcard-redeem-api-addon.phpCVE reference, Wordfence
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208474%40woo-gift-cards-lite&new=3208474%40woo-gift-cards-lite&sfp_email=&sfph_mail=CVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.