The Ultimate Gift Cards for WooCommerce plugin permits authenticated users with Administrator privilege to execute a boolean‑based SQL injection through the 'default_price' and 'product_id' parameters within the wps_wgm_save_post function. The input is insufficiently escaped and the query is not prepared, enabling attackers to append additional SQL commands that can read sensitive database content.

This flaw exists in all versions of the wpswings Ultimate Gift Cards for WooCommerce plugin up to and including 3.1.4, a WordPress plugin that manages gift card functionality in WooCommerce stores.

With a CVSS score of 4.9 the vulnerability is moderate, and an EPSS score of less than 1% indicates low likelihood of exploitation. It is not currently listed in the CISA KEV catalog. Because exploitation requires Administrator authentication, the risk is confined to environments where such credentials are present; external adversaries lacking credentials cannot leverage the defect.