CVE-2026-88814: YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition
The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YITH WooCommerce Gift Cardsto a version that resolves this vulnerability.Fixed in 4.38.1
Event History
Frequently Asked Questions
Does an attacker need a WordPress or store account to exploit this issue?
No. Exploitation is unauthenticated, but the attacker must possess a valid gift card code.
What must an attacker do with the gift card code to exceed its balance?
They must submit multiple checkouts using the same code at the same time. The race condition can allow those concurrent redemptions to spend more than the card's funded value.
Which plugin versions are affected?
YITH WooCommerce Gift Cards versions before 4.38.1 are affected.