YITH WooCommerce Gift Cards: Gift card balance inflation via discounted purchase
Summary
The YITH WooCommerce Gift Cards WordPress plugin up to and including version 4.39.0 credits a newly issued gift card with the item's pre-discount price instead of the amount actually paid. A customer can apply an ordinary store coupon at checkout and receive a gift card worth more than they paid. The CVE record describes the attack as possible without authentication, but the exact conditions (for example guest checkout) are not confirmed.
Affected
- YITH WooCommerce Gift Cards up to and including 4.39.0
- Versions before 4.39.0 are assumed affected (record lists 0 to <= 4.39.0)
Fixed in
Unknown. No vendor fix has been confirmed for this issue. Version 4.38.1 fixes a different issue (CVE-2026-88814) and must not be assumed to fix CVE-2026-88813.
Workaround
- Disable the gift card feature, or prevent coupons from being applied to gift card purchases (generic advice, not vendor guidance)
- Review issued gift cards and orders: compare each card's value with the amount paid and look for cards issued from coupon-discounted orders
Exploitation
- Not listed in the CISA KEV catalog according to secondary sources; verify on cisa.gov
- No public proof of concept found (secondary sources)
- Exploitation evidence: unknown
- CISA SSVC: exploitation none, automatable yes, technical impact partial
Our recommendation
- Check whether your web shop sells YITH gift cards
- Audit gift cards issued from coupon-discounted orders and compare values with amounts paid
- Restrict coupon use on gift card purchases or temporarily disable gift card sales until a fix is confirmed
- Keep the plugin on the latest release and check the YITH changelog and NVD/WPScan for a fix in the coming days
- Monitor gift card redemptions for unusually high balances
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- CVE Record CVE-2026-88813 www.cve.org
- WordPress.org plugin page wordpress.org
- OffSeq Threat Radar radar.offseq.com
- VulDB entry vuldb.com
- TheHackerWire CVE-2026-88813 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:00.
Original description (NVD)
The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.