CVE-2024-11423
Published: 08 January 2025
Summary
CVE-2024-11423 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
The Ultimate Gift Cards for WooCommerce plugin for WordPress is affected by an authorization vulnerability (CWE-862) in all versions through 3.0.6. The root cause is missing capability checks on multiple REST API endpoints, including /wp-json/gifting/recharge-giftcard, which allows callers to alter gift-card balances without any authentication or payment processing.
Unauthenticated attackers reachable over the network can therefore add arbitrary credit to existing gift cards or drain balances at will. The flaw carries a CVSS 3.1 score of 7.5, reflecting high impact on data integrity with no required privileges or user interaction.
Public references point to WordPress plugin-trac changesets that address the missing authorization checks; site operators are therefore advised to update the plugin to a version newer than 3.0.6. The associated EPSS score rose from a low baseline to a peak of 0.3220 on 2025-12-11 before receding, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34182
Vulnerability details
The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and Use Advance Coupons With Personalized Templates plugin for WordPress is vulnerable to unauthorized modification…
more
of data due to a missing capability check on several REST API endpoints such as /wp-json/gifting/recharge-giftcard in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to recharge a gift card balance, without making a payment along with reducing gift card balances without purchasing anything.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization on public REST endpoints in WordPress plugin directly enables remote unauthenticated exploitation of a public-facing application for unauthorized data modification.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access to API endpoints, directly preventing unauthorized modifications to gift card balances due to missing capability checks.
Implements least privilege to restrict API endpoints to only authorized users or roles necessary for gift card recharge and balance reduction functions.
Limits permitted actions without identification or authentication on sensitive REST API endpoints like /wp-json/gifting/recharge-giftcard to prevent unauthenticated data modifications.