{"id":"CVE-2026-88814","kind":"vulnerability","aliases":["CVE-2026-88814"],"related":[],"title":"YITH WooCommerce Gift Cards: race condition lets gift cards be overspent","description":"The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.","summary":"The YITH WooCommerce Gift Cards WordPress plugin does not lock a gift card's balance during checkout, so redeeming the same code in parallel checkouts can spend more than the card holds. An attacker holding a gift card code can obtain goods or credit worth more than the card's funded value.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress","yith-gift-cards"],"not_affected_if":["plugin-not-installed","plugin-version-4.38.1-or-later"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in the plugin's main file header.\n- Confirm whether the YITH WooCommerce Gift Cards plugin is active on the store.","fix":"- YITH WooCommerce Gift Cards: move to `4.38.1` or later.","status":"open","published_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","triaged_at":"2026-11-05T06:33:01+00:00","updated_at":"2026-11-05T06:33:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T06:33:01Z","model":"claude-haiku-5-5","output":{"fix":"- YITH WooCommerce Gift Cards: move to `4.38.1` or later.","reach":"internet","title":"YITH WooCommerce Gift Cards: race condition lets gift cards be overspent","impact":"medium","summary":"The YITH WooCommerce Gift Cards WordPress plugin does not lock a gift card's balance during checkout, so redeeming the same code in parallel checkouts can spend more than the card holds. An attacker holding a gift card code can obtain goods or credit worth more than the card's funded value.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","yith-gift-cards","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Gift card balance overspent through concurrent checkouts, causing direct financial loss.","analyst_note":"","how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in the plugin's main file header.\n- Confirm whether the YITH WooCommerce Gift Cards plugin is active on the store.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-version-4.38.1-or-later"],"who_is_affected":"Online stores running the YITH WooCommerce Gift Cards plugin on WordPress with WooCommerce checkout enabled, before version 4.38.1. The flaw is in the redemption path at checkout, so stores that do not sell or accept gift cards through this plugin can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":4229,"output_tokens":575,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-88814':14A,17A '4.38.1':88C 'allow':106C 'atom':93C 'attack':61B,108C 'balanc':42B,99C 'card':4A,9A,27B,32B,40B,58B,65B,76B,84C,97C,113C 'checkout':44B,52B,105C,125C 'code':49B,66B,114C,129C 'condit':6A 'credit':71B 'cve':12A,15A 'fund':78B,120C 'gift':3A,8A,26B,31B,39B,64B,83C,96C,112C 'good':69B 'hold':59B,62B,110C 'host':21B 'let':7A 'lock':37B,91C 'multipl':124C 'obtain':68B 'oversp':11A 'packag':18B 'parallel':51B 'plugin':34B,86C 'race':5A 'redeem':46B,103C 'self':20B 'self-host':19B 'spend':54B,116C 'submit':123C 'time':133C 'updat':94C 'valu':79B,121C 'woocommerc':2A,22B,30B,82C 'wordpress':23B,33B,85C 'worth':72B 'yith':1A,25B,29B,81C 'yith-gift-card':24B","nicknames":[],"mitigations":[],"who_affected":"Online stores running the YITH WooCommerce Gift Cards plugin on WordPress with WooCommerce checkout enabled, before version 4.38.1. The flaw is in the redemption path at checkout, so stores that do not sell or accept gift cards through this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["package","selfhosted","unknown","woocommerce","wordpress","yithgiftcards"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88814","severity":null,"published_at":"2026-11-05T06:17:09+00:00","modified_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","fetched_at":"2026-11-05T06:31:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}