Vulnerability. Gift card codes accesible

  • Hi, I’ve using the plugin for over a year, and it has been working correctly. On october we created around 20 gift cards manually to reward some clients. One of them used his last night correctly, and somehow used 16 others buying the same product with the same discount (using different gift card codes not sent to him) until the product run out of stock. Only the first purchase showed the discount code at the orders page on woocommerce, but they all showed it on our new order email notifications. Then he proceeded to use the purchase points he won with his purchases, by buying other products.
    We proceeded to deactivate the plugin and cancel all his orders and points, and are waiting for him to send us his bank info to send him his money back.
    If I can help with something, let me know.

    The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Support Juan Coronel

    (@juaancmendez)

    Hi there,
    we hope you’re doing well!

    It really is strange what has happened to you. Could you confirm if you had our plugin, WC and WP updated to the latest version when this happened to you?

    Please let me know.

    Best regards.

    Thread Starter carolaword

    (@carolaword)

    Hola Juan,
    Yes we were very concerned about this too. Your plugin and wordpress had the latest version, WC 9.0.2. I update everything every end of the month. Investigating this we realize this user has been using the website’s benefits “too much”, he has figure out how to receive more than he should. We also noticed the gift card codes we sent had consecutives numbers. So maybe mixing this with the detail we didn’t put attention to that the codes could be used by any user, not only by the recipient’s email address user, created this issue. He said… “the website just kept offering the discount so I kept purchasing”, until 3 am every 20 minutes. That’s all we’ve learned about this.
    I hope this helps, thanks

    Plugin Support Juan Coronel

    (@juaancmendez)

    Hello there,

    The generation of gift card codes is random, so it is strange that they appear with consecutive numbers. Additionally, it should be possible to use the gift card only once for each order, until the balance is $0.

    I just checked this locally and it works correctly.

    If you need us to review that on your site, it may be best to do it on a test site. You can easily create one using the free WP Staging plugin.

    Let us know any news.

    Best regards.

    Thread Starter carolaword

    (@carolaword)

    Hi, I created the codes manually, I deleted the plugin now so I can’t check if I can create them consecutively, but I think I can. And as I said, he made 16 purchases, one for each gift card.

    What I think could’ve helped is that only the user that received the gift card was abel to use it, not anyone.

    Thanks

Viewing 4 replies - 1 through 4 (of 4 total)
  • You must be logged in to reply to this topic.