CVE-2026-91020

5.3 Moyenne

Publiée le 02/10/2026 à 09:16 · Modifiée le 02/10/2026 à 20:00 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the configured denominations and manipulating the order total to obtain products without paying.

Traduire en français

Produits concernés

Unknown WebToffee Gift Cards for WooCommerce

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	contact@wpscan.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-472

Références

https://wpscan.com/vulnerability/998db4a0-693c-4701-a37e-ec33002e1417/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories