CVE-2026-88813: YITH WooCommerce Gift Cards <= 4.39.0 - Unauthenticated Gift Card Balance Inflation via Discounted Purchase

Q: Who can exploit this issue?

Any customer who can purchase a gift card and apply an ordinary store coupon during checkout may be able to exploit it. The issue does not require authentication beyond whatever access the store requires to place an order.

Q: What conditions are required for exploitation?

The store must sell gift cards through the affected plugin and allow a discount coupon to be applied to the gift-card purchase. The gift card is credited at its pre-discount item price rather than the amount paid.

Q: How can I check whether this has already been exploited?

Review gift-card orders that used coupons and compare the amount paid with the value issued on the resulting gift card. A card balance greater than the discounted purchase amount indicates the affected behavior.

Q: What can be done until the plugin is updated?

Prevent coupons from being applied to gift-card products, or temporarily stop selling gift cards through the affected checkout flow. Review and remediate any previously issued cards whose value exceeded the amount paid.

Published Nov 11, 2026

Updated

The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid.

Affected Software

1 affected component

YITH WooCommerce Gift Cards<=4.39.0

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any customer who can purchase a gift card and apply an ordinary store coupon during checkout may be able to exploit it. The issue does not require authentication beyond whatever access the store requires to place an order.

What conditions are required for exploitation?

The store must sell gift cards through the affected plugin and allow a discount coupon to be applied to the gift-card purchase. The gift card is credited at its pre-discount item price rather than the amount paid.

How can I check whether this has already been exploited?

Review gift-card orders that used coupons and compare the amount paid with the value issued on the resulting gift card. A card balance greater than the discounted purchase amount indicates the affected behavior.

What can be done until the plugin is updated?

Prevent coupons from being applied to gift-card products, or temporarily stop selling gift cards through the affected checkout flow. Review and remediate any previously issued cards whose value exceeded the amount paid.

CVE-2026-88813: YITH WooCommerce Gift Cards <= 4.39.0 - Unauthenticated Gift Card Balance Inflation via Discounted Purchase

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What conditions are required for exploitation?

How can I check whether this has already been exploited?

What can be done until the plugin is updated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What conditions are required for exploitation?

How can I check whether this has already been exploited?

What can be done until the plugin is updated?