CVE-2024-13520 – This vulnerability allows unauthenticated attac... (How to Fix)

Q: What is the severity of CVE-2024-13520?

CVE-2024-13520 has a CVSS score of 5.3 (MEDIUM). This vulnerability allows unauthenticated attackers to modify gift voucher values, expiration dates, and user notes in WordPress sites using the Gift Cards plugin. Any WordPress site with this plugin installed and not updated is affected. Attackers can manipulate gift card data without any authentication.

📋 TL;DR

This vulnerability allows unauthenticated attackers to modify gift voucher values, expiration dates, and user notes in WordPress sites using the Gift Cards plugin. Any WordPress site with this plugin installed and not updated is affected. Attackers can manipulate gift card data without any authentication.

💻 Affected Systems

Products:

Gift Cards (Gift Vouchers and Packages) WordPress plugin

Versions: All versions up to and including 4.4.6

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects WordPress installations with this specific plugin enabled.

📦 What is this software?

Gift Vouchers by Codemenschen

View all CVEs affecting Gift Vouchers →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could devalue all gift cards to zero, set immediate expiration dates, and add malicious notes, causing complete loss of gift card functionality and financial damage to the business.

🟠

Likely Case

Attackers will modify gift card values and expiration dates to steal value or disrupt gift card operations, leading to financial loss and customer service issues.

🟢

If Mitigated

With proper network controls and monitoring, unauthorized modifications can be detected and prevented before significant damage occurs.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability is simple to exploit as it requires no authentication and involves basic HTTP requests to specific endpoints.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.4.7 or later

Vendor Advisory: https://plugins.trac.wordpress.org/browser/gift-voucher/trunk/include/edit-order-voucher.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'Gift Cards (Gift Vouchers and Packages)'. 4. Click 'Update Now' if available, or download version 4.4.7+ from WordPress repository. 5. Activate the updated plugin.

🔧 Temporary Workarounds

Disable vulnerable endpoints via .htaccess

linux

Block access to the vulnerable PHP files using Apache mod_rewrite rules

RewriteEngine On
RewriteRule ^wp-content/plugins/gift-voucher/include/edit-order-voucher\.php$ - [F,L]

Temporarily disable plugin

all

Deactivate the Gift Cards plugin until patched

wp plugin deactivate gift-voucher

🧯 If You Can't Patch

Disable the Gift Cards plugin completely
Implement web application firewall rules to block requests to /wp-content/plugins/gift-voucher/include/edit-order-voucher.php

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Gift Cards plugin version. If version is 4.4.6 or lower, you are vulnerable.

Check Version:

wp plugin get gift-voucher --field=version

Verify Fix Applied:

Confirm plugin version is 4.4.7 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

HTTP POST requests to /wp-content/plugins/gift-voucher/include/edit-order-voucher.php
Unusual modifications to gift voucher records in database

Network Indicators:

POST requests to gift voucher endpoints from unauthenticated sources
Unusual patterns of gift card value changes

SIEM Query:

source="web_logs" AND uri="/wp-content/plugins/gift-voucher/include/edit-order-voucher.php" AND method="POST"

📊 Metadata

CVE ID: CVE-2024-13520

CVSS v3 Score: 5.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE: CWE-862

EPSS Score: 0.48% exploit probability (64.3th percentile)

Published: February 20, 2025

Last Updated: February 25, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-13520, you might also want to check these: