CVE-2026-91020CWE-472

CVE-2026-91020

Medium · published October 2, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
17.3
In the wild
Unconfirmed
What it is

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the configured denominations and manipulating the order total to obtain products without paying.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00264 · 17.3th percentile
Weakness
CWE-472 · External Control of Assumed-Immutable Web Parameter
Published
2026-10-02T11:16Z
References (1)
https://wpscan.com/vulnerability/998db4a0-693c-4701-a37e-ec33002e1417/ · [email protected]
EPSS history
Timeline
  • 03 OCT 03:47Z
    EPSS moved — → 0%
    epss
  • 02 OCT 06:56Z
    WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount
    cvelistv5