CVE-2026-15039
Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload
CVSS Score
9.8
EPSS Score
0.2%
EPSS Percentile
12th
The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.
| Vendor | unknown |
| Product | giftware |
| Published | Aug 12, 2026 |
| Last Updated | Aug 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown giftware
Be the first to know when new critical vulnerabilities affecting unknown giftware are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / giftware
0 < 4.2.10
References
Credits
Brandon Steed WPScan