CVE-2026-91020 — WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount

CVE-2026-91020

WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount PUBLISHED

Description (CNA)

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the configured denominations and manipulating the order total to obtain products without paying.

Affected (CNA)

Vendor / product	Versions
Unknown / WebToffee Gift Cards for WooCommerce	affected 0 before 1.3.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/998db4a0-693c-4701-a37e-ec33002e1417/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.