CVE-2026-91020 - WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount

Back Back to CVE browser

MEDIUM

WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount

Published Oct 2, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the configured denominations and manipulating the order total to obtain products without paying.

Affected products

Vendor n/a Product WebToffee Gift Cards for WooCommerce Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.3.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

WebToffee Gift Cards for WooCommerce

unaffected

Version	Status	Constraints
0	affected	<1.3.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-472

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91214
Advisory
https://wpscan.com/vulnerability/998db4a0-693c-4701-a37e-ec33002e1417/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91214		Advisory
https://wpscan.com/vulnerability/998db4a0-693c-4701-a37e-ec33002e1417/		exploitvdb-entrytechnical-description