CVE-2026-91020 Overview
CVE-2026-91020 is a business logic flaw in the WebToffee Gift Cards for WooCommerce WordPress plugin before version 1.3.1. The plugin fails to validate user-supplied gift card amounts on the server side. Attackers submit arbitrary or negative values, which the plugin accepts as the cart-item price and store-credit coupon value. This bypasses the configured denominations and manipulates the order total. Unauthenticated users can obtain products without paying by crafting malicious requests to the gift card purchase workflow. The vulnerability is tracked under [CWE-472: External Control of Assumed-Immutable Web Parameter].
Critical Impact
Unauthenticated attackers can manipulate order totals in WooCommerce stores running the vulnerable plugin, obtaining products at reduced or zero cost.
Affected Products
- WebToffee Gift Cards for WooCommerce plugin versions prior to 1.3.1
- WordPress sites running WooCommerce with the vulnerable gift card extension
- E-commerce deployments exposing the gift card purchase workflow to unauthenticated users
Discovery Timeline
- 2026-10-02 - CVE-2026-91020 published to NVD
- 2026-10-02 - Last updated in NVD database
Technical Details for CVE-2026-91020
Vulnerability Analysis
The plugin exposes a client-controlled parameter representing the gift card amount during the WooCommerce add-to-cart workflow. The server accepts this value without validating it against the administrator-configured denominations. The submitted value propagates directly into two places: the cart-item price and the generated store-credit coupon value. An attacker submits an arbitrary low or negative amount to purchase a gift card for pennies, then redeems the resulting coupon for its inflated face value. Alternatively, a negative price reduces the overall cart total, allowing checkout of other paid products at or below zero cost.
Root Cause
The root cause is missing server-side validation of a trust-boundary parameter, categorized under [CWE-472]. The plugin assumes the gift card amount submitted by the browser matches one of the configured denominations. No authoritative check reconciles the submitted value against the allowed denomination set before writing the value into cart state or into the issued store-credit coupon.
Attack Vector
Exploitation requires no authentication and no user interaction. An attacker intercepts or crafts an HTTP POST request to the gift card add-to-cart endpoint and substitutes the amount field with an arbitrary numeric value, including negative numbers. The modified value flows through to the cart total and coupon issuance logic. The attacker completes checkout and receives a coupon whose face value exceeds the amount actually paid.
No verified public proof-of-concept code is available. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-91020
Indicators of Compromise
- Orders in WooCommerce containing gift card line items with prices that do not match any configured denomination.
- Issued store-credit coupons with face values exceeding the order payment total.
- Negative line-item prices or unusually low totals in completed orders containing gift card products.
- Spikes in gift card purchases from new or unauthenticated customer sessions.
Detection Strategies
- Audit the WooCommerce orders table for gift card SKUs where the recorded price falls outside the configured denomination set.
- Correlate issued coupon values with the payment captured by the payment gateway to identify discrepancies.
- Inspect web server access logs for POST requests to gift card add-to-cart endpoints containing suspicious amount parameter values.
Monitoring Recommendations
- Enable WooCommerce order logging and alert on orders where coupon value exceeds payment amount.
- Deploy a web application firewall rule to flag or block requests containing negative numeric values in gift card amount parameters.
- Review store-credit coupon redemption reports daily until the plugin is patched.
How to Mitigate CVE-2026-91020
Immediate Actions Required
- Update the WebToffee Gift Cards for WooCommerce plugin to version 1.3.1 or later immediately.
- Audit recent orders and issued coupons for anomalous amounts and revoke suspicious coupons.
- Temporarily disable the gift card plugin if patching cannot be performed in a short window.
Patch Information
The vendor addressed the vulnerability in version 1.3.1 of the Gift Cards for WooCommerce plugin by introducing server-side validation of the submitted gift card amount against the configured denominations. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the plugin until an upgrade to 1.3.1 or later is deployed.
- Add a web application firewall rule rejecting POST requests to the gift card purchase endpoint when the amount parameter is negative or outside the allowed denomination set.
- Manually review and approve gift card orders before fulfillment to catch tampered amounts.
# Example WAF rule concept - block negative or non-numeric gift card amounts
# ModSecurity-style pseudocode
SecRule ARGS:gift_card_amount "@lt 1" \
"id:1009102,phase:2,deny,status:403,msg:'Invalid gift card amount'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.