Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.
CVE-2026-45444: Gift Cards For WooCommerce Pro
Critical CVSS (10.0) reachable over local.
TL;DR - CVE-2026-45444 is a critical unrestricted file upload vulnerability in WP Swings Gift Cards For WooCommerce Pro through version 4.2.6. - Update to the latest vendor release, verify that it is newer than 4.2.6, or disable the plugin if no fixed release is available. - No confirmed public proof of concept or active exploitation was identified, but arbitrary file upload can lead to site compromise.
What Happened?
CVE-2026-45444 affects the WordPress Gift Cards For WooCommerce Pro plugin from WP Swings. The issue is classified as CWE-434, Unrestricted Upload of File with Dangerous Type. An attacker may upload a malicious file through affected plugin functionality.
Depending on the upload path and server configuration, successful exploitation could enable code execution, website defacement, persistence, data theft, or broader WordPress compromise. Organizations should also review their wider response process using this actively exploited vulnerability incident playbook if suspicious activity is discovered.
Available NVD and advisory records identify versions through 4.2.6 as affected. The records state that mitigation is available but do not identify a specific fixed version. Administrators should verify the installed release through the official vendor or WordPress distribution channel rather than assume that version 4.2.6 is safe.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-45444 |
| CVSS base score | 10.0 Critical |
| CVSS vector | Not included in the retrieved NVD data |
| Attack vector | Not explicitly disclosed; exploitation occurs through vulnerable plugin upload functionality |
| Authentication required | Not disclosed in the available records |
| Affected product | Gift Cards For WooCommerce Pro by WP Swings |
| Affected versions | <= 4.2.6 |
| Patch available | Mitigation is reported as available, but fixed version is not confirmed |
| CISA KEV status | Not listed |
| Published | 20 May 2026 |
The absence of a published CVSS vector and authentication detail is material. Defenders should not infer that authentication is required or absent without vendor-confirmed technical data. Until the exploit path is clarified, treat every internet-facing installation running version 4.2.6 or earlier as exposed.
Analyst’s Take: The missing endpoint, authentication requirements, and fixed version make exploitability harder to assess from the available records. That uncertainty should not delay action: verify the vendor release, patch installations running 4.2.6 or earlier, or disable the plugin when no fixed release is available.
Root Cause and Potential Impact
The root cause is an unrestricted upload of a dangerous file type in Gift Cards For WooCommerce Pro. The plugin accepts or processes an uploaded file without sufficiently enforcing the expected file type, content, destination, or execution restrictions.
The available advisory does not disclose the vulnerable function, endpoint, nonce requirements, capability checks, or exact validation failure. That missing implementation detail limits exploit-specific detection and prevents a reliable conclusion about whether exploitation requires a logged-in WordPress account.
File extension checks alone are not sufficient protection. Attackers may use alternate extensions, content-type manipulation, polyglot files, double extensions, or upload paths that are later interpreted by the web server.
The practical impact depends on the deployment architecture. If uploaded files are stored in a web-accessible directory where PHP or another server-side language can execute, a successful upload may become remote code execution. Even where execution is blocked, attackers may still place malicious content, overwrite files, host phishing pages, or abuse the WordPress site for malware distribution.
Who Needs to Act?
Organizations need to act if they operate WordPress with Gift Cards For WooCommerce Pro version 4.2.6 or earlier. The affected range is reported as <= 4.2.6, while the NVD expresses the lower bound as unspecified and the upper bound as 4.2.6.
Inventory should include:
- Production sites
- Staging systems
- Dormant WooCommerce stores
- Multisite instances
- Backups that may be restored into service
A plugin can remain exploitable even when its associated storefront is not actively used, particularly if WordPress administration or upload endpoints remain reachable.
| Product | Affected range | Fixed version |
|---|---|---|
| Gift Cards For WooCommerce Pro | <= 4.2.6 |
Not identified in the available advisory data |
The fixed version must be confirmed directly from WP Swings or the official plugin distribution channel. Do not treat 4.2.6 as remediated. If the vendor channel offers a release newer than 4.2.6, verify its changelog and installed version after upgrading. If no newer release is available, disable or remove the plugin while preserving evidence and validating business impact.
Why Is the CVSS Score Critical?
The assigned CVSS base score is 10.0, Critical, the maximum base score. The available NVD material does not include the vector string, so individual metrics cannot be independently confirmed.
In particular, the records do not establish:
- Whether the attack is network-accessible without authentication
- Whether user interaction is required
- Whether the vulnerable operation is reachable by a low-privileged WordPress account
The severity is nevertheless understandable from the vulnerability class. Unrestricted upload of a dangerous file can provide a route to persistent content placement or server-side code execution. If exploitation is possible remotely and without meaningful privileges, the vulnerability could have high confidentiality, integrity, and availability impact.
Administrators should avoid translating the 10.0 score into a claim that every installation is immediately remotely exploitable. Web-server execution rules, WordPress hardening, upload directory permissions, web application firewalls, authentication controls, and the unknown vulnerable endpoint all affect practical risk. The correct operational response is to patch or disable first, then use local testing and logs to determine exposure details.
Has CVE-2026-45444 Been Exploited?
No confirmed exploitation in the wild was identified in the reviewed NVD, CISA, or Patchstack material. CVE-2026-45444 is not listed in the CISA Known Exploited Vulnerabilities catalog. Consequently, no CISA KEV date, remediation due date, required action, or ransomware-campaign flag was identified for this CVE.
No verified public proof of concept, exploit repository, or reproducible exploit publication was identified in the available research. This supports the statement that neither confirmed active exploitation nor a verified public PoC is known from the reviewed sources. It does not prove that exploitation has not occurred privately or that the issue cannot be exploited.
A non-KEV status should not be interpreted as a low-risk designation. WordPress vulnerabilities are frequently scanned for after disclosure, and arbitrary file upload bugs can be valuable to attackers even when technical details are limited. Internet-facing sites should be prioritized according to exposure, business importance, and evidence of suspicious upload activity.
Security Hygiene for WordPress Administrators
A critical plugin vulnerability is also an opportunity to review baseline WordPress controls. Keep WordPress core, themes, plugins, and server software updated; remove unused extensions; restrict administrative access; and use strong, unique credentials.
Where appropriate, consider a reputable endpoint and site protection product such as Get Bitdefender →. Security software cannot replace patching, but it may help identify malicious files or suspicious behavior during follow-up investigation.
For broader control alignment, compare your environment with the CIS Critical Security Controls list, particularly controls covering asset inventory, vulnerability management, account management, and logging.
Detection Guidance
Identify Affected Plugin Versions
Begin by identifying affected plugin versions across all WordPress installations. The following WP-CLI command reports the installed version for the plugin slug supplied by the advisory:
wp plugin get giftware --field=name,version,status --format=table
Because plugin slugs and vendor packaging can vary, confirm the result in the WordPress admin interface and plugin directory metadata. Search the filesystem for plugin directories and version headers if the command does not find the installation:
grep -RniE "Gift Cards For WooCommerce|WP Swings|Version:" wp-content/plugins/ 2>/dev/null
Review Upload and Web Requests
Review web-server access logs for requests that resulted in file uploads, unexpected PHP files, or newly created files under wp-content/uploads. The exact vulnerable endpoint is not disclosed, so defenders should search broadly for POST requests to WordPress and plugin paths:
grep -E '"POST .*wp-admin|POST .*wp-json|POST .*gift|POST .*upload' /var/log/nginx/access.log \
| grep -Ei 'multipart|upload|giftware|woocommerce'
A useful investigation pattern is a successful upload followed by a request for a newly created PHP file in the uploads tree:
POST /wp-admin/admin-ajax.php ... 200
GET /wp-content/uploads/2026/11/<unexpected-file>.php ... 200
The path and status values will differ by deployment. This is an investigative pattern rather than a confirmed CVE-specific signature.
Search for PHP, CGI, or other executable content below upload directories:
find wp-content/uploads -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' -o -iname '*.cgi' \) -print
Also check:
- File creation and modification times
- WordPress administrator accounts
- Scheduled tasks
- Unfamiliar plugins
- Modified theme files
- Outbound connections from the web server
Preserve suspicious files before deletion, calculate hashes, and correlate them with web-server, PHP, WordPress, hosting, and WAF logs.
Remediation and Patching
First, back up the site and database, record the current plugin version, and test the upgrade in a staging environment where feasible. Then update Gift Cards For WooCommerce Pro through the official vendor or WordPress distribution mechanism.
The exact fixed version is not identified in the available records. The operational requirement is to install a vendor release newer than 4.2.6, after confirming that the release is the vendor’s security remediation.
A typical WP-CLI workflow is:
wp maintenance-mode activate
wp db export /secure-backups/site-$(date +%F).sql
wp plugin update giftware
wp plugin get giftware --field=version
wp maintenance-mode deactivate
The command assumes that the plugin slug is giftware, as indicated by the advisory URL. Verify the slug locally before running it, and use the official vendor package if WP-CLI reports that no update is available.
If the resulting version is not newer than 4.2.6, the site remains within the reported affected range.
Disable or Remove the Plugin
If no fixed release is available, disable the plugin:
wp plugin deactivate giftware
Where the plugin is not required, remove it after preserving the package and relevant evidence:
wp plugin delete giftware
Block Script Execution in Upload Directories
As a compensating control, configure the web server to prevent script execution in WordPress upload directories.
For Apache, a site-specific configuration may include:
<Directory "/var/www/html/wp-content/uploads">
Options -ExecCGI
RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8
RemoveType .php .phtml .php3 .php4 .php5 .php7 .php8
</Directory>
For Nginx, ensure that the PHP location block does not process files beneath the uploads path. A deployment-specific example is:
location ~* ^/wp-content/uploads/.*\.(php|phtml|phar)$ {
deny all;
}
Test configuration syntax and behavior before deployment. These controls reduce the impact of uploaded server-side files but do not replace patching.
Continue monitoring for malicious files, unauthorized accounts, altered WordPress files, and outbound connections after remediation. If compromise indicators are found, isolate the site, preserve forensic evidence, rotate WordPress and hosting credentials, invalidate sessions, inspect persistence, and restore only from a trusted backup.
References
-
NVD: CVE-2026-45444
CVE identification, severity, affected product, and version ceiling. -
Patchstack advisory: Gift Cards For WooCommerce Pro arbitrary file upload
Arbitrary file upload characterization, affected range<= 4.2.6, and mitigation availability. -
CISA Known Exploited Vulnerabilities Catalog
Consulted for exploitation status. CVE-2026-45444 was not listed in the reviewed catalog data.
The available records do not provide a confirmed fixed version, complete CVSS vector, detailed vulnerable code path, verified public PoC, or confirmed in-the-wild exploitation report. Those gaps require direct vendor verification and conservative defensive action. Patch or disable the affected plugin first, then use local testing and log review to establish whether the installation shows signs of exposure or compromise.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.