CVE-2026-88813
YITH WooCommerce Gift Cards <= 4.39.0 - Unauthenticated Gift Card Balance Inflation via Discounted Purchase
CVE-2026-88813 is a medium vulnerability (CVSS 5.3) in Unknown Yith Woocommerce Gift Cards, published November 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. No source names a fixed version.
- Severity
- 5.3 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.23%EPSS, 14th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
What each source reports
CVE List Score used
YITH WooCommerce Gift Cards <= 4.39.0 - Unauthenticated Gift Card Balance Inflation via Discounted Purchase
The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid.
- Record
CVE-2026-88813- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-11
EUVDEUVD-2026-123210
The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid.
- Record
EUVD-2026-123210- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-11
GitHub AdvisoriesGHSA-j228-c9r3-cqm8
The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a...
The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid.
- Record
GHSA-j228-c9r3-cqm8- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-11
NVD
The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid.
- Record
CVE-2026-88813- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-11
History
| Recorded | Changed | Sources |
|---|---|---|
| severity | CVE List | |
| cwes, severity | GitHub Advisories | |
| severity | EUVD, NVD | |
| published | EUVD | |
| aliases, products | EUVD | |
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.