[ CVE-2026-88814 · Published 5 Nov 2026 ]
Vulnerability in Unknown YITH WooCommerce Gift Cards
Not scored yet
No fix listed yet
[ Description ]Official description
The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.