CVE-2026-45444

The vulnerability classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) results from the lack of proper verification of the type and content of files uploaded by the plugin. An attacker can upload an executable file (such as a PHP webshell) to the server without the need for authentication, authorization, or user interaction. The network attack vector (AV:N) with no required privileges (PR:N) and no user interaction (UI:N) means that the exploit can be executed remotely by anyone with access to the network.

An attacker can gain the ability to execute code remotely (RCE) on the server by running an uploaded malicious file, which can lead to complete server takeover, data theft, website content modification, and lateral movement in the hosting infrastructure.

The 'Gift Cards For WooCommerce Pro' plugin should be updated immediately to a version higher than 4.2.6. Detailed information about available patches can be found in the producer's references and in the Patchstack database. Until the update is performed, it is recommended to consider temporarily disabling the plugin.

The 'Gift Cards For WooCommerce Pro' plugin by WP Swings in versions from its inception through 4.2.6 inclusive, running on the WordPress platform with WooCommerce.