WordPress Plugin Vulnerabilities

Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload

Description

The plugin does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.

Proof of Concept

Affects Plugins

Plugin icon
giftware
Fixed in 4.2.10

References

CVE
CVE-2026-15039

Miscellaneous

Original Researcher
Brandon Steed
Submitter
Brandon Steed
Verified
Yes
WPVDB ID
b7b3308c-430e-4bc3-a3df-da20d47cf314

Timeline

Publicly Published
2026-08-10 (about 2 days ago)
Added
2026-08-10 (about 1 day ago)
Last Updated
2026-08-11 (about 8 hours ago)

Other

Published
Title
Published
2014-08-01
Title
accordion - Arbitrary File Upload
Published
2021-01-28
Title
Super Forms < 4.9.703 - Unauthenticated PHP File Upload to RCE
Published
2026-07-22
Title
MapSVG – Vector maps, Image maps, Google Maps < 8.14.1 - Authenticated (Admin+) Arbitrary File Upload
Published
2024-05-07
Title
AI Engine: ChatGPT Chatbot < 2.2.70 - Authenticated (Editor+) Arbitrary File Upload
Published
2025-11-20
Title
URL Image Importer < 1.0.7 - Authenticated (Author+) Arbitrary File Upload