Vulnerabilities / YITH WooCommerce Gift Cards / WPSEC-2026-1838
YITH WooCommerce Gift Cards <= 4.38.0 - Unauthenticated Race Condition to Gift Card Balance Overspending
Low 3.7
CWE-362Fixed in 4.38.1
- ID
- WPSEC-2026-1838
- Plugin
- YITH WooCommerce Gift Cards (yith-woocommerce-gift-cards)
- Affected
- all versions before 4.38.1
- Remediation
- Update to 4.38.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-362
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-28
- Attack surface
- YITH WooCommerce Gift Cards on WPSec AttackSurface
- Fix released
- Published
Description
The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to a Race Condition via gift card balance deduction during checkout in all versions up to, and including, 4.38.0, due to the balance being updated with a non-atomic read-modify-write and no check that the remaining balance covers the amount being deducted. This makes it possible for unauthenticated attackers, such as guest customers holding a gift card, to submit several checkouts with the same gift card at the same time and spend more than the card's actual balance.
References
- https://wpsec.com/vuln/WPSEC-2026-1838/
- https://plugins.svn.wordpress.org/yith-woocommerce-gift-cards/tags/4.38.1/
- https://wordpress.org/plugins/yith-woocommerce-gift-cards/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS