CVE-2024-11423
HIGHThe Ultimate Gift Cards for WooCommerce <3.0.6 - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-11423. PoCs published by RandomRobbieBF.
AI-analyzed exploit summary The repository contains a functional proof-of-concept exploit for CVE-2024-11423, demonstrating an unauthorized modification of gift card balances via a missing capability check on the WooCommerce REST API endpoint `/wp-json/gifting/recharge-giftcard`. The provided `curl` command successfully recharges a gift card balance without authentication.
Description
The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints such as /wp-json/gifting/recharge-giftcard in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to recharge a gift card balance, without making a payment along with reducing gift card balances without purchasing anything.
Exploits (1)
The repository contains a functional proof-of-concept exploit for CVE-2024-11423, demonstrating an unauthorized modification of gift card balances via a missing capability check on the WooCommerce REST API endpoint `/wp-json/gifting/recharge-giftcard`. The provided `curl` command successfully recharges a gift card balance without authentication.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N