WordPress Plugin Vulnerabilities

Gift Up Gift Cards for WordPress and WooCommerce < 3.1.8 - Unauthenticated Server-Side Request Forgery

Description

The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.7. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
gift-up
Fixed in 3.1.8

References

CVE
CVE-2026-32412
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/541fbcd6-353f-4ef7-88f1-fc81a6b73e04

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Nguyen Ba Khanh
Verified
No
WPVDB ID
dcbcf210-e12f-4a23-9ebb-a9d891bf0d12

Timeline

Publicly Published
2026-02-25 (about 2 months ago)
Added
2026-05-05 (about 19 days ago)
Last Updated
2026-05-05 (about 19 days ago)

Other

Published
Title
Published
2021-02-06
Title
Like Button Rating < 2.6.32 - Unauthenticated Full-Read SSRF
Published
2024-05-30
Title
Church Admin < 4.4.0 - Authenticated (Admin+) Server-Side Request Forgery
Published
2022-10-21
Title
Better Messages < 1.9.10.69 - Subscriber+ SSRF
Published
2025-11-05
Title
Blog2Social: Social Media Auto Post & Scheduler < 8.6.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_url
Published
2023-11-13
Title
Church Admin < 3.8.0 - Server-Side Request Forgery (SSRF)