CVE-2026-88814

Full vulnerability record from the local CVENow database.

Description

The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-05 06:17:09.590000

Last modified

2026-11-05 06:17:09.590000

View original CVE JSON

{
  "id": "CVE-2026-88814",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-05T06:17:09.590",
  "lastModified": "2026-11-05T06:17:09.590",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "YITH WooCommerce Gift Cards",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "4.38.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/f30bd830-2fce-4644-b483-406b0770017b/",
      "source": "[email protected]"
    }
  ]
}