Brief Summary: CVE-2026-45444 — Critical Arbitrary File Upload in WP Swings Gift Cards For WooCommerce Pro

Introduction

Attackers are exploiting an unauthenticated arbitrary file upload vulnerability in a popular WooCommerce plugin, in mass campaigns across thousands of WordPress sites, and no vendor patch exists yet. CVE-2026-45444 carries the maximum CVSS score of 10.0 and affects all versions of Gift Cards For WooCommerce Pro through 4.2.6.

WP Swings develops free and premium plugins for WooCommerce, the dominant ecommerce platform for WordPress. Gift Cards For WooCommerce Pro lets store owners sell and manage digital and physical gift cards, gift certificates, and store credits. WooCommerce powers millions of online stores, so a vulnerability in one of its plugins can expose a large number of sites.

Technical information

CVE-2026-45444 is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. The plugin does not properly restrict which file types can be uploaded to the server. An attacker can submit files with dangerous extensions (such as PHP scripts) without authenticating.

The CVSS 3.1 vector string assigned by MITRE is:

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Each component of the vector:

• Attack Vector (AV:N): The vulnerability is exploitable over the network. Any attacker with HTTP access to the target site can reach the vulnerable endpoint.
• Attack Complexity (AC:L): The attacker needs no special conditions or preparation beyond sending a crafted request.
• Privileges Required (PR:N): No authentication is required, which is the most dangerous rating for this metric.
• User Interaction (UI:N): Exploitation does not depend on any action from a legitimate user.
• Scope (S:C): The impact extends beyond the vulnerable component, so a compromised plugin can lead to a compromised hosting environment.
• Confidentiality, Integrity, Availability (C:H/I:H/A:H): All three are rated high, reflecting the potential for complete system takeover.

Attack flow

Based on the available advisory information, exploitation follows a simple pattern:

1. The attacker identifies a WordPress site running Gift Cards For WooCommerce Pro version 4.2.6 or earlier.
2. The attacker sends a crafted HTTP request to the vulnerable upload functionality and submits a malicious file (e.g., a PHP web shell) without authenticating.
3. The plugin accepts the upload without adequate file type validation and stores the file on the server in a web-accessible location.
4. The attacker requests the uploaded file by its URL, and the server executes the malicious code.
5. With code execution, the attacker has a backdoor into the server and can use it for data exfiltration, lateral movement, defacement, or further attacks.

As of this writing, public advisories have not disclosed the specific vulnerable parameter or endpoint, and the NVD assessment is still pending. Security teams should watch Patchstack and NVD for technical indicators of compromise as they are published.

Affected systems and versions

The vulnerability affects:

• Plugin: Gift Cards For WooCommerce Pro (slug: giftware)
• Vendor: WP Swings
• Affected versions: All versions from the initial release through version 4.2.6 (inclusive)
• Platform: WordPress with WooCommerce

Version 4.2.6 was released on March 24, 2026. Its changelog lists only compatibility updates and new features, with no security fixes. No available version fixes this vulnerability.

Vendor security history

WP Swings states on its security and compliances page that it adheres to the SOC 2, ISO 27001, and GDPR compliance frameworks. Its handling of CVE-2026-45444 does not match that picture. The latest plugin version (4.2.6) predates the vulnerability disclosure by nearly two months, and its changelog contains no security-related changes. As of May 20, 2026, the vendor has not released a patch for a vulnerability that carries the maximum possible severity score and is confirmed to be under active exploitation. Organizations that weigh vendor security posture in procurement decisions should account for this gap between compliance certifications and real-world vulnerability response.

References

• Patchstack Advisory: WordPress Gift Cards For WooCommerce Pro Plugin 4.2.6 Arbitrary File Upload Vulnerability
• NVD Entry: CVE-2026-45444
• MITRE CVE Record: CVE-2026-45444
• WP Swings Gift Cards For WooCommerce Pro Changelog
• WP Swings Security and Compliances
• WP Swings Gift Cards For WooCommerce Pro Product Page