# CVE-2026-88813: YITH WooCommerce Gift Cards price inflation in discounted purchases

Source: https://junglewise.ai/threats/cve-2026-88813-the-yith-woocommerce-gift-cards-wordpress-plugin-through-4-39-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-88813 · Severity: info · Published 2026-11-11

The YITH WooCommerce Gift Cards plugin for WordPress fails to verify that issued gift card values match the amount customers actually paid. By applying a store coupon during checkout, customers can receive a gift card worth significantly more than their purchase price, allowing them to extract profit from the store's gift card system.

Vendors: [YITH](https://junglewise.ai/threats/vendors/yith).

## Quick answers

**Is CVE-2026-88813 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88813 being exploited in the wild.

**How severe is CVE-2026-88813?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** YITH WooCommerce Gift Cards through 4.39.0.

**Is there a fix for CVE-2026-88813?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88813 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-88813?** Check whether you run YITH WooCommerce Gift Cards at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin credits newly issued gift cards with the pre-discount item price rather than the actual amount paid, allowing unauthenticated customers to exploit this price reconciliation flaw. An attacker applies a standard coupon at checkout to reduce the purchase price, but the gift card is still credited at the full pre-discount value. This access control bypass (CWE-284) requires only customer-level access to the shopping cart and checkout flow.

## Affected products

- YITH WooCommerce Gift Cards through 4.39.0

## Timeline

- 2026-11-09: disclosed
- 2026-11-11: advisory

## References

- [https://wpscan.com/vulnerability/fc7e0837-640d-461d-aac3-cd58c8137c14/](https://wpscan.com/vulnerability/fc7e0837-640d-461d-aac3-cd58c8137c14/)

## Related threats

- [YITH WooCommerce Gift Cards race condition in balance redemption](https://junglewise.ai/threats/cve-2026-88814-the-yith-woocommerce-gift-cards-wordpress-plugin-before-4-38-1)