CVE-2026-88814

Name of the Vulnerable Software and Affected Versions YITH WooCommerce Gift Cards versions prior to 4.38.1

Description A race condition exists due to a non-atomic read-modify-write operation on the gift card balance. This occurs when a gift card is redeemed at checkout, as the system fails to lock or atomically update the balance. An unauthenticated attacker possessing a valid gift card code with a non-zero balance can spend more than the funded value by submitting multiple simultaneous checkout requests to bypass the balance check before it is decremented.

Recommendations Update YITH WooCommerce Gift Cards to version 4.38.1 or later.