WordPress Plugin Vulnerabilities

YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition

Description

The plugin does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.

Proof of Concept

Affects Plugins

Plugin icon
yith-woocommerce-gift-cards
Fixed in 4.38.1

References

CVE
CVE-2026-88814

Classification

Type
RACE CONDITION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-362
CVSS
3.7 (low)

Miscellaneous

Original Researcher
ryan fabella
Submitter
ryan fabella
Verified
Yes
WPVDB ID
f30bd830-2fce-4644-b483-406b0770017b

Timeline

Publicly Published
2026-11-02 (about 3 days ago)
Added
2026-11-02 (about 2 days ago)
Last Updated
2026-11-02 (about 2 days ago)

Other

Published
Title
Published
2025-07-30
Title
myCred < 2.9.4.4 - Authenticated (Subscriber+) Race Condition
Published
2026-10-26
Title
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy < 3.7.2 - Unauthenticated Discount Code Limit Bypass
Published
2025-09-22
Title
MasterStudy LMS < 3.6.21 - Authenticated (Subscriber+) Race Condition to Multiple Reviews
Published
2026-10-08
Title
Tutor LMS – eLearning and online course solution < 4.2.0 - Authenticated (Subscriber+) Race Condition
Published
2022-08-31
Title
WP-PostRatings < 1.90 - Ratings Tempering via Race Condition