WebToffee fixes gift-card value validation flaw in WooCommerce plugin

WebToffee released version 1.3.1 of its free Gift Cards for WooCommerce plugin on September 24, 2026, addressing a value-validation weakness. WPScan’s September 28 advisory identifies the finding as CVE-2026-91020; the CVE Program record was published separately on October 2. Those are different points in the remediation and disclosure sequence. [S01][S04][S05]

Value integrity and the distribution of a remedy

The WPScan-assigned CVE record says versions before 1.3.1 did not validate a customer-supplied gift-card amount on the server before using it for the cart price and store-credit value. It describes an unauthenticated amount-manipulation weakness capable of distorting the order total. This is a defect in reconciling authorised value with payment, rather than evidence that a legitimate recipient’s entire balance was stolen. [S04]

The affected identifier is wt-gift-cards-woocommerce. The free product issues digital gift-card codes, emails them to recipients and supports partial redemption with the remaining balance retained. WebToffee’s separately marketed premium product has its own version numbering; the reviewed advisory does not establish that it is affected. [S01][S02][S03]

The vendor’s complete changelog credits researcher Berke Bodur for the vulnerability fixed in 1.3.1, matching WPScan’s researcher attribution. Its next listed release, 1.3.2 on October 19, is described as a WooCommerce compatibility update. The September 24 release remains the dated security remedy in the reviewed record. [S01][S05]

WordPress.org’s daily series shows 22 downloads on September 23, 547 on the September 24 release date and 234 on September 25. The advisory date, September 28, records 78. These observations describe repository activity around the remedy; they do not identify the downloaded version or establish what caused a change in activity. [S06]