by Kastro
Paper/Archive/CVE-2026-15039

CVE-2026-15039

Unknown giftware — Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload

EPSS 0.8%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.6.576 × 2011.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.

Affected

ProductAffectedFixed inSource
giftware< 4.2.104.2.10CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/b7b3308c-430e-4bc3-a3df-da20d47cf314