CVE-2026-88813 · Package
NO FIX YET
The YITH WooCommerce Gift Cards WordPress plugin, through version 4.39.0, issues gift cards worth the item's pre-discount price rather than the amount paid. A customer who applies a normal store coupon at checkout can receive a gift card worth more than they paid.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Stores on WordPress with WooCommerce that sell gift cards through the YITH WooCommerce Gift Cards plugin up to version 4.39.0 are exposed when customers can use coupons at checkout. Stores that do not sell gift cards with this plugin can skip it.
Not affected if gift-cards-not-sold, plugin-not-installed
Who cares gift-cards, woocommerce, wordpress, yith
4.39.0 or earlier.No fix yet, per the sources.
The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.