CVE-2026-45444: WP Swings Gift Cards For WooCommerce Pro
CVE-2026-45444 is an unrestricted file upload weakness in the WP Swings Gift Cards For WooCommerce Pro WordPress plugin, affecting versions up to and including 4.2.6, as reported by Patchstack. The record assigns a CVSS 3.1 base score of 10 (critical) with network attack vector and no privileges or user interaction required. No confirmed exploitation appears in the sources consulted, and the CISA KEV catalog does not list this CVE.
Overview
CVE-2026-45444 describes an unrestricted upload of file with dangerous type (CWE-434) in the WP Swings Gift Cards For WooCommerce Pro plugin for WordPress. The record was published on 2026-05-20 and the CNA is Patchstack. The record status is Deferred in the consulted data.
Impact
The CVSS 3.1 vector reported by Patchstack (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates a network-reachable issue with low complexity, no required privileges and no user interaction, with high confidentiality, integrity and availability impact and scope change. The SSVC data lists technical impact as total and automatable as yes.
Affected products and versions
- WP Swings Gift Cards For WooCommerce Pro, versions up to and including 4.2.6.
The record does not list a fixed version.
Exploitation status
The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00522 with a percentile of 0.42707.
Remediation and mitigation
- Identify any installation of Gift Cards For WooCommerce Pro and compare its version with the affected range.
- Check the vendor and the Patchstack entry for updated fix information.
- Restrict upload capabilities and review which roles can submit files until a fixed version is confirmed.
Detection guidance
- Review upload directories for unexpected executable or script file types and recent file creation events.
- Monitor web server logs for unusual requests to plugin upload endpoints.
Limitations of the available information
The record does not provide a fixed version, the specific vulnerable endpoint, or technical details of the upload handling. The description states the affected range as from n/a through 4.2.6. Whether the vulnerability is exploitable without authentication should be verified against the vendor data.
Frequently asked questions
What versions of Gift Cards For WooCommerce Pro are affected?
The record lists versions up to and including 4.2.6. No fixed version is given in the consulted data.
Is this vulnerability being actively exploited?
The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do now?
Identify installations, check the vendor and Patchstack entry for fix updates, and restrict file upload permissions until a fixed version is confirmed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.