CVE-2026-88814
YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.
| Vendor | unknown |
| Product | yith woocommerce gift cards |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown yith woocommerce gift cards
Be the first to know when new unknown vulnerabilities affecting unknown yith woocommerce gift cards are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / YITH WooCommerce Gift Cards
0 < 4.38.1
References
Credits
ryan fabella WPScan