{"affected":[{"defaultStatus":"unaffected","product":"YITH WooCommerce Gift Cards","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.38.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-88814","cwes":["CWE-362"],"description":"The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/f30bd830-2fce-4644-b483-406b0770017b/"}],"kev":null,"metrics":[],"modifiedAt":1793858426609,"publishedAt":1793858426609,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/f30bd830-2fce-4644-b483-406b0770017b/"}],"remediation":[],"revision":"c13effd5f33c58002a8b8a26708c37c014e8f22fc9cc561b56a382786bb6f906","sources":[{"modifiedAt":1793858426609,"name":"CNA: WPScan","retrievedAt":1793859015177,"url":"https://www.cve.org/CVERecord?id=CVE-2026-88814"}],"ssvc":null,"status":"published","title":"YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition","updatedAt":1793859015177}