{"id":"CVE-2026-88813","kind":"vulnerability","aliases":["CVE-2026-88813"],"related":[],"title":"YITH WooCommerce Gift Cards: coupons let buyers get over-valued gift cards","description":"The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid.","summary":"The YITH WooCommerce Gift Cards WordPress plugin, through version 4.39.0, issues gift cards worth the item's pre-discount price rather than the amount paid. A customer who applies a normal store coupon at checkout can receive a gift card worth more than they paid.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gift-cards","package","woocommerce","wordpress","yith"],"not_affected_if":["gift-cards-not-sold","plugin-not-installed"],"how_to_check":"- Check whether the YITH WooCommerce Gift Cards plugin is installed and its version is `4.39.0` or earlier.\n- Review gift cards issued through checkout with coupons applied for values above the amount paid.","fix":null,"status":"open","published_at":"2026-11-11T06:17:21+00:00","first_seen_at":"2026-11-11T06:25:45+00:00","triaged_at":"2026-11-11T06:27:07+00:00","updated_at":"2026-11-11T06:27:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:27:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"YITH WooCommerce Gift Cards: coupons let buyers get over-valued gift cards","impact":"medium","summary":"The YITH WooCommerce Gift Cards WordPress plugin, through version 4.39.0, issues gift cards worth the item's pre-discount price rather than the amount paid. A customer who applies a normal store coupon at checkout can receive a gift card worth more than they paid.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","yith","gift-cards"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Customers receive gift cards worth more than they paid","analyst_note":"Confirm the fixed version and any vendor patch from the NVD entry or the YITH plugin changelog; the sources give no fix.","how_to_check":"- Check whether the YITH WooCommerce Gift Cards plugin is installed and its version is `4.39.0` or earlier.\n- Review gift cards issued through checkout with coupons applied for values above the amount paid.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","gift-cards-not-sold"],"who_is_affected":"Stores on WordPress with WooCommerce that sell gift cards through the YITH WooCommerce Gift Cards plugin up to version 4.39.0 are exposed when customers can use coupons at checkout. Stores that do not sell gift cards with this plugin can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000742,"input_tokens":4567,"output_tokens":571,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-88813':16A,19A '4.39.0':36B,81C 'actual':96C 'allow':114C 'amount':51B,95C 'appli':56B,117C 'buyer':7A 'card':4A,13A,22B,31B,39B,67B,77C,90C,104C,128C 'checkout':62B,123C 'coupon':5A,60B,121C 'credit':101C 'custom':54B,115C 'cve':14A,17A 'discount':46B,111C 'get':8A 'gift':3A,12A,21B,30B,38B,66B,76C,89C,127C 'gift-card':20B 'instead':100C 'issu':37B,92C 'item':42B,107C 'let':6A 'new':103C 'normal':58B 'ordinari':119C 'over-valu':9A 'packag':23B 'paid':52B,72B,97C,133C 'plugin':33B,79C 'pre':45B,110C 'pre-discount':44B,109C 'price':47B,112C 'rather':48B 'receiv':64B,125C 'reconcil':84C 'store':59B,120C 'valu':11A,86C 'version':35B 'woocommerc':2A,24B,29B,75C 'wordpress':25B,32B,78C 'worth':40B,68B,129C 'yith':1A,26B,28B,74C","nicknames":[],"mitigations":[],"who_affected":"Stores on WordPress with WooCommerce that sell gift cards through the YITH WooCommerce Gift Cards plugin up to version 4.39.0 are exposed when customers can use coupons at checkout. Stores that do not sell gift cards with this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["giftcards","medium","package","woocommerce","wordpress","yith"],"campaign_type":null,"search_a":"'-2026':15A,18A '-88813':16A,19A 'buyer':7A 'card':4A,13A 'coupon':5A 'cve':14A,17A 'get':8A 'gift':3A,12A 'let':6A 'over-valu':9A 'valu':11A 'woocommerc':2A 'yith':1A","search_b":"'4.39.0':36B 'amount':51B 'appli':56B 'card':22B,31B,39B,67B 'checkout':62B 'coupon':60B 'custom':54B 'discount':46B 'gift':21B,30B,38B,66B 'gift-card':20B 'issu':37B 'item':42B 'normal':58B 'packag':23B 'paid':52B,72B 'plugin':33B 'pre':45B 'pre-discount':44B 'price':47B 'rather':48B 'receiv':64B 'store':59B 'version':35B 'woocommerc':24B,29B 'wordpress':25B,32B 'worth':40B,68B 'yith':26B,28B","search_c":"'4.39.0':81C 'actual':96C 'allow':114C 'amount':95C 'appli':117C 'card':77C,90C,104C,128C 'checkout':123C 'coupon':121C 'credit':101C 'custom':115C 'discount':111C 'gift':76C,89C,127C 'instead':100C 'issu':92C 'item':107C 'new':103C 'ordinari':119C 'paid':97C,133C 'plugin':79C 'pre':110C 'pre-discount':109C 'price':112C 'receiv':125C 'reconcil':84C 'store':120C 'valu':86C 'woocommerc':75C 'wordpress':78C 'worth':129C 'yith':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88813","severity":null,"published_at":"2026-11-11T06:17:21+00:00","modified_at":"2026-11-11T06:17:21+00:00","first_seen_at":"2026-11-11T06:25:45+00:00","fetched_at":"2026-11-11T06:25:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}