A missing authorization check in the VillaTheme GIFT4U WordPress plugin allows users to view or modify gift card data that they should not be able to access. Because the plugin does not enforce proper permission boundaries, administrators and other privileged users could potentially exploit this weakness, granting unauthorized privileges over gift card creation, redemptions, and financial information. The vulnerability is catalogued with a CVSS score of 6.9, indicating a moderate risk profile.

All WordPress installations using the VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo plugin version 1.1.3 or earlier are affected. The issue applies to every site that has the plugin enabled, regardless of its overall WordPress configuration or third‑party plugins.

The CVSS score of 6.9 reflects a moderate severity and a medium likelihood of exploitation if an attacker can authenticate to the site. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be the web interface, where an attacker can use the malformed access control to reach administrative gift‑card functions. The risk is elevated for sites that grant broad permissions to non‑administrator roles. Given the lack of a public exploit, the current threat remains primarily theoretical but should be mitigated promptly to prevent potential abuse.