vulnerability

WordPress Plugin: gift-voucher: CVE-2024-13520: Missing Authorization

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:N/I:P/A:N)

Published

Feb 19, 2025

Added

May 15, 2025

Modified

Apr 30, 2026

Description

The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'update_voucher_price', 'update_voucher_date', 'update_voucher_note' functions in all versions up to, and including, 4.4.9. This makes it possible for unauthenticated attackers to update the value, expiration date, and user note for any gift voucher.

Solution

gift-voucher-plugin-cve-2024-13520

References

https://www.cve.org/CVERecord?id=CVE-2024-13520
https://www.wordfence.com/threat-intel/vulnerabilities/id/190a21cd-9716-4a57-a793-63309c339427?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-4619
CVE-2024-13520
https://attackerkb.com/topics/CVE-2024-13520
CWE-862
EUVD-EUVD-2025-4619

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report