← CVE Radar
CVE-2026-88814YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition
The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.
3.7 LOWEPSS 0.13%Not in KEVNVD: Deferred
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 3.7 | LOW | 3.1CISA-ADP | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
Details
- CVE ID
- CVE-2026-88814
- Status
- Deferred
- Assigner (CNA)
- WPScan
- Published
- Nov 5, 2026
- Last modified
- 2026-11-06 13:17 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
UnknownYITH WooCommerce Gift Cards1 version range
- before 4.38.1