{"id":"CVE-2026-88814","aliases":["EUVD-2026-117342","GHSA-r9cj-c36h-r5w3"],"status":"published","title":"YITH WooCommerce Gift Cards \u003c 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition","description":"The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00131,"percentile":0.02762,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-362"],"published":"2026-11-05T06:00:26Z","modified":"2026-11-06T12:04:06Z","products":[{"vendor":"unknown","product":"yith woocommerce gift cards"},{"vendor":"yith","product":"yith woocommerce gift cards"}],"references":[{"url":"https://wpscan.com/vulnerability/f30bd830-2fce-4644-b483-406b0770017b/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88814"},{"url":"https://wpscan.com/vulnerability/f30bd830-2fce-4644-b483-406b0770017b"},{"url":"https://github.com/advisories/GHSA-r9cj-c36h-r5w3"}],"sources":{"cve":[{"id":"CVE-2026-88814","title":"YITH WooCommerce Gift Cards \u003c 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition","description":"The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.","status":"published","published":"2026-11-05T06:00:26.609Z","modified":"2026-11-06T12:04:06.843Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-362"],"updated_at":"2026-11-06T13:28:12.24582Z"}],"euvd":[{"id":"EUVD-2026-117342","description":"The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.","status":"published","published":"2026-11-05T06:00:26Z","modified":"2026-11-06T12:04:06Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-06T13:04:55.758116Z"}],"ghsa":[{"id":"GHSA-r9cj-c36h-r5w3","title":"The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update...","description":"The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.","status":"published","published":"2026-11-05T06:34:38Z","modified":"2026-11-06T15:31:26Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-362"],"updated_at":"2026-11-06T16:00:40.695019Z"}],"nvd":[{"id":"CVE-2026-88814","description":"The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.","status":"published","published":"2026-11-05T06:17:09.59Z","modified":"2026-11-06T13:17:31.913Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-362"],"updated_at":"2026-11-06T16:00:36.254659Z"}]}}