{"cve":"CVE-2026-88814","enrichment":{"created":"2026-11-05T08:00:17.765669+00:00","updated":"2026-11-05T08:00:17.765675+00:00","vendors":[],"weaknesses":["CWE-362"]},"mitre":{"cpes":[],"created":"2026-11-05T06:00:26.609000+00:00","description":"The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/88xxx/CVE-2026-88814.json","references":["https://wpscan.com/vulnerability/f30bd830-2fce-4644-b483-406b0770017b/"],"title":"YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition","updated":"2026-11-05T06:00:26.609000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-11-05T06:17:09.590000+00:00","description":"The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-88814.json","references":["https://wpscan.com/vulnerability/f30bd830-2fce-4644-b483-406b0770017b/"],"title":null,"updated":"2026-11-05T06:17:09.590000+00:00","vendors":[],"weaknesses":[]},"opencve":{"changes":[{"created":"2026-11-05T06:15:00+00:00","data":[{"details":{"new":"The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.","old":null},"type":"description"},{"details":{"new":"YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition","old":null},"type":"title"},{"details":{"added":["https://wpscan.com/vulnerability/f30bd830-2fce-4644-b483-406b0770017b/"],"removed":[]},"type":"references"}],"id":"09a3e265-aa64-43b0-9b23-e1558fc2ce93"},{"created":"2026-11-05T08:15:00+00:00","data":[{"details":{"added":["CWE-362"],"removed":[]},"type":"weaknesses"}],"id":"be61a645-394d-4909-92b6-a751ffa800bc"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T06:00:26.609000+00:00","provider":"mitre"},"description":{"data":"The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://wpscan.com/vulnerability/f30bd830-2fce-4644-b483-406b0770017b/"],"providers":["mitre","nvd"]},"title":{"data":"YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition","provider":"mitre"},"updated":{"data":"2026-11-05T08:00:17.765675+00:00","provider":"enrichment"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":["CWE-362"],"providers":["enrichment"]}}}