CVE-2026-91020: WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount
The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the configured denominations and manipulating the order total to obtain products without paying.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WebToffee Gift Cards for WooCommerceto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites running WebToffee Gift Cards for WooCommerce versions earlier than 1.3.1 are affected. Exploitation can be performed by unauthenticated users over the network.
What does an attacker need to do to exploit it?
An attacker needs to submit a crafted wt_credit_amount value when adding or purchasing a gift card. The vulnerable plugin uses that user-supplied value without server-side validation, including arbitrary or negative amounts.
What is the practical impact?
An attacker can bypass configured gift-card denominations and manipulate the order total. This may allow products to be obtained without payment.
How can I tell whether my site is affected?
Check whether the WebToffee Gift Cards for WooCommerce plugin version is earlier than 1.3.1. Affected versions do not validate the wt_credit_amount value server-side before using it for the cart-item price and store-credit coupon value.