Canonical URL: https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/ --- description: Version 1.3.1, released September 24, addresses a flaw that WPScan says could let unauthenticated users manipulate gift-card value and order totals. title: WebToffee fixes gift-card value validation flaw in WooCommerce plugin image: https://giftcard.news/images/social/v1/webtoffee-fixes-gift-card-value-validation-flaw-woocommerce-plugin-84bb68ddc48a623525acd09f3b0a15db.jpg --- 1. [Home](https://giftcard.news/) 2. [Fraud & Security](https://giftcard.news/fraud-security/) # WebToffee fixes gift-card value validation flaw in WooCommerce plugin Version 1.3.1, released September 24, addresses a flaw that WPScan says could let unauthenticated users manipulate gift-card value and order totals. By [Oliver Reed](https://giftcard.news/author/oliver-reed/) September 24, 2026 3 min read [ Google News ](https://google.com/preferences/source?q=giftcard.news&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) Share [ ](https://x.com/intent/post?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fwebtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020%2F%3Futm%5Fsource%3Dx%26utm%5Fmedium%3Dsocial&text=WebToffee+fixes+gift-card+value+validation+flaw+in+WooCommerce+plugin&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "X") [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fwebtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020%2F%3Futm%5Fsource%3Dlinkedin%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "LinkedIn") [ ](https://wa.me/?text=WebToffee+fixes+gift-card+value+validation+flaw+in+WooCommerce+plugin+https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fwebtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020%2F%3Futm%5Fsource%3Dwhatsapp%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "WhatsApp") ![WebToffee gift-card product icon with a card and ribbon on a blue background](https://giftcard.news/images/variants/v1/webtoffee-fixes-gift-card-value-validation-flaw-woocommerce-plugin-product-icon-ribbon-w256.webp) Official WebToffee gift-card product icon. The advisory concerns the free WooCommerce plugin identified in the report. Photo: WebToffee [WebToffee](https://giftcard.news/company/webtoffee/) released version 1.3.1 of its free Gift Cards for WooCommerce plugin on September 24, 2026, addressing a value-validation weakness. [WPScan](https://giftcard.news/organization/wpscan-organization-bcb1fed4/)’s September 28 advisory identifies the finding as CVE-2026-91020; the CVE Program record was published separately on October 2\. Those are different points in the remediation and disclosure sequence. [\[S01\]](#article-source-1)[\[S04\]](#article-source-4)[\[S05\]](#article-source-5) ## Value integrity and the distribution of a remedy The WPScan-assigned CVE record says versions before 1.3.1 did not validate a customer-supplied gift-card amount on the server before using it for the cart price and store-credit value. It describes an unauthenticated amount-manipulation weakness capable of distorting the order total. This is a defect in reconciling authorised value with payment, rather than evidence that a legitimate recipient’s entire balance was stolen. [\[S04\]](#article-source-4) The affected identifier is wt-gift-cards-woocommerce. The free product issues digital gift-card codes, emails them to recipients and supports partial redemption with the remaining balance retained. WebToffee’s separately marketed premium product has its own version numbering; the reviewed advisory does not establish that it is affected. [\[S01\]](#article-source-1)[\[S02\]](#article-source-2)[\[S03\]](#article-source-3) The vendor’s complete changelog credits researcher [Berke Bodur](https://giftcard.news/person/berke-bodur/) for the vulnerability fixed in 1.3.1, matching WPScan’s researcher attribution. Its next listed release, 1.3.2 on October 19, is described as a WooCommerce compatibility update. The September 24 release remains the dated security remedy in the reviewed record. [\[S01\]](#article-source-1)[\[S05\]](#article-source-5) WordPress.org’s daily series shows 22 downloads on September 23, 547 on the September 24 release date and 234 on September 25\. The advisory date, September 28, records 78\. These observations describe repository activity around the remedy; they do not identify the downloaded version or establish what caused a change in activity. [\[S06\]](#article-source-6) The data behind the story ### Daily repository downloads: WebToffee Gift Cards for WooCommerce Official daily counts for September 14-October 4, 2026, spanning the security-remediation and disclosure period. Retrieved October 19. Repository-reported downloads downloads Tap or hover for details. All values are also available in the data table. Source WordPress.org official daily plugin-download API, retrieved October19,2026 Repository activity, not unique stores, affected installations, gift-card sales or confirmed security updates. The response does not identify downloaded versions, successful installation or exploitation. Date labels are reproduced as returned; the API does not state a reporting timezone. No missing days are filled. Show data tableHide data table Scroll left or right to see all columns __Daily repository downloads: WebToffee Gift Cards for WooCommerce (downloads)__ | Category | Repository-reported downloads | | ---------- | ----------------------------- | | 2026-09-14 | 30 downloads | | 2026-09-15 | 28 downloads | | 2026-09-16 | 17 downloads | | 2026-09-17 | 22 downloads | | 2026-09-18 | 22 downloads | | 2026-09-19 | 10 downloads | | 2026-09-20 | 12 downloads | | 2026-09-21 | 19 downloads | | 2026-09-22 | 22 downloads | | 2026-09-23 | 22 downloads | | 2026-09-24 | 547 downloads | | 2026-09-25 | 234 downloads | | 2026-09-26 | 51 downloads | | 2026-09-27 | 50 downloads | | 2026-09-28 | 78 downloads | | 2026-09-29 | 78 downloads | | 2026-09-30 | 57 downloads | | 2026-10-01 | 49 downloads | | 2026-10-02 | 74 downloads | | 2026-10-03 | 143 downloads | | 2026-10-04 | 29 downloads | The same installation can generate more than one repository interaction, and the returned daily series supplies no unique-store or completed-installation measure. The 547 figure must not be described as 547 merchants protected by the fix. It also says nothing about gift cards issued, unpaid orders or the number of successful attacks. [\[S06\]](#article-source-6) The current public WPScan page confirms the affected plugin, fix version, researcher and September 28 publication. The structured CVE record supplies the technical scope, while the vendor changelog independently establishes its release date. The reviewed records do not report observed exploitation, compromised-store counts or quantified merchant losses. [\[S01\]](#article-source-1)[\[S04\]](#article-source-4)[\[S05\]](#article-source-5) For a gift-card merchant, the material control is that a selected amount must match the value the store authorises and collects before creating spending credit. Public release and download records make the remedy’s availability visible, but leave the installed patch level and loss history of individual stores unresolved. [\[S04\]](#article-source-4)[\[S05\]](#article-source-5)[\[S06\]](#article-source-6) ## In this article ### Companies * [WebToffee](https://giftcard.news/company/webtoffee/) ### People * [Berke Bodur](https://giftcard.news/person/berke-bodur/) ### Organizations * [WPScan](https://giftcard.news/organization/wpscan-organization-bcb1fed4/) ### Sources and documents * [\[S01\] Original vulnerability disclosure and affected-version scope](https://wpscan.com/vulnerability/998db4a0-693c-4701-a37e-ec33002e1417/?utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — WPScan * [\[S02\] Vendor plugin description and September 24 security-fix changelog](https://wordpress.org/plugins/wt-gift-cards-woocommerce/?utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — WebToffee via WordPress.org * [\[S03\] Separate premium product and company context](https://www.webtoffee.com/product/woocommerce-gift-cards/?utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — WebToffee * [\[S04\] WPScan-assigned CVE record and affected-version scope](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91020.json?utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — CVE Program / WPScan * [\[S05\] Complete vendor release chronology, including September24 security fix](https://plugins.svn.wordpress.org/wt-gift-cards-woocommerce/trunk/changelog.txt?utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — WebToffee via WordPress.org SVN * [\[S06\] Original daily repository-download series](https://api.wordpress.org/stats/plugin/1.0/downloads.php?slug=wt-gift-cards-woocommerce&limit=60&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — WordPress.org Share [ ](https://x.com/intent/post?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fwebtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020%2F%3Futm%5Fsource%3Dx%26utm%5Fmedium%3Dsocial&text=WebToffee+fixes+gift-card+value+validation+flaw+in+WooCommerce+plugin&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "X") [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fwebtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020%2F%3Futm%5Fsource%3Dlinkedin%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "LinkedIn") [ ](https://wa.me/?text=WebToffee+fixes+gift-card+value+validation+flaw+in+WooCommerce+plugin+https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fwebtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020%2F%3Futm%5Fsource%3Dwhatsapp%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "WhatsApp") ![Portrait of Oliver Reed](https://giftcard.news/images/variants/v1/oliver-reed-editorial-portrait-w320.webp) About the author ## [Oliver Reed](https://giftcard.news/author/oliver-reed/) Journalist — Industry Deals & Research Oliver Reed covers industry acquisitions, investment and market research for Gift Card News. From reading to building ## Your next move in gift cards. Tell us what you’re building. We’ll help you explore suitable providers. [Find a provider ](https://giftcard.news/find-a-provider/) ## Related articles [Fraud & Security](https://giftcard.news/fraud-security/) News ### [giftee Group estimates JPY 550 million loss after unauthorized e-gift issuance](https://giftcard.news/fraud-security/giftee-unauthorized-egift-issuance-estimated-loss-2026/) [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) October 26, 2026 3 min [Fraud & Security](https://giftcard.news/fraud-security/) News ### [San Francisco settlement creates $1.525 million Vanilla gift-card fund](https://giftcard.news/fraud-security/san-francisco-vanilla-gift-card-restitution-fund/) [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) October 23, 2026 4 min [Fraud & Security](https://giftcard.news/fraud-security/) News ### [Valuedesign reports card-data leak as MOS resets PINs](https://giftcard.news/fraud-security/valuedesign-value-card-data-leak-mos-card-2026/) [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) October 23, 2026 4 min ```json {"@context":"https://schema.org","@graph":[{"@type":"NewsMediaOrganization","@id":"https://giftcard.news/#publisher","name":"Gift Card News","url":"https://giftcard.news/","description":"News and analysis covering gift cards, retail, loyalty, rewards and payments worldwide.","logo":{"@type":"ImageObject","url":"https://giftcard.news/icon-512.png","contentUrl":"https://giftcard.news/icon-512.png","width":512,"height":512,"@id":"https://giftcard.news/#logo"},"publishingPrinciples":"https://giftcard.news/editorial-policy/","correctionsPolicy":"https://giftcard.news/editorial-policy/"},{"@type":"WebSite","@id":"https://giftcard.news/#website","url":"https://giftcard.news/","name":"Gift Card News","description":"News and analysis covering gift cards, retail, loyalty, rewards and payments worldwide.","inLanguage":"en","publisher":{"@id":"https://giftcard.news/#publisher"},"potentialAction":{"@type":"SearchAction","target":"https://giftcard.news/search/?q={search_term_string}","query-input":"required name=search_term_string"}},{"@type":"Person","@id":"https://giftcard.news/author/oliver-reed/#person","name":"Oliver Reed","url":"https://giftcard.news/author/oliver-reed/","description":"Oliver Reed covers industry acquisitions, investment and market research for Gift Card News.","jobTitle":"Journalist — Industry Deals & Research","image":{"@type":"ImageObject","url":"https://giftcard.news/images/oliver-reed-editorial-portrait.webp","contentUrl":"https://giftcard.news/images/oliver-reed-editorial-portrait.webp","width":1254,"height":1254,"caption":"Illustrated portrait representing the Oliver Reed editorial profile.","@id":"https://giftcard.news/images/oliver-reed-editorial-portrait.webp#image","encodingFormat":"image/webp","description":"Illustrated portrait for Oliver Reed, Gift Card News","creditText":"Gift Card News / AI-generated illustration"}},{"@type":"ImageObject","url":"https://giftcard.news/images/webtoffee-fixes-gift-card-value-validation-flaw-woocommerce-plugin-product-icon-ribbon.webp","contentUrl":"https://giftcard.news/images/webtoffee-fixes-gift-card-value-validation-flaw-woocommerce-plugin-product-icon-ribbon.webp","width":256,"height":256,"caption":"Official WebToffee gift-card product icon. The advisory concerns the free WooCommerce plugin identified in the report.","@id":"https://giftcard.news/images/webtoffee-fixes-gift-card-value-validation-flaw-woocommerce-plugin-product-icon-ribbon.webp#image","encodingFormat":"image/webp","description":"WebToffee gift-card product icon with a card and ribbon on a blue background","creditText":"WebToffee","isBasedOn":"https://www.webtoffee.com/product/woocommerce-gift-cards/"},{"@type":"Dataset","@id":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#dataset","url":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/","name":"WebToffee fixes gift-card value validation flaw in WooCommerce plugin: figure data","description":"Tabular data for the figures accompanying \"WebToffee fixes gift-card value validation flaw in WooCommerce plugin\". Sources, units and limitations are documented with each figure.","inLanguage":"en","isPartOf":{"@id":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#article"},"isAccessibleForFree":false,"hasPart":[{"@id":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#article-figure-1-dataset"}],"distribution":{"@type":"DataDownload","contentUrl":"https://giftcard.news/download.csv?article=%2Ffraud-security%2Fwebtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020%2F","encodingFormat":"text/csv","isAccessibleForFree":false}},{"@type":"Dataset","@id":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#article-figure-1-dataset","url":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#article-figure-1","name":"Daily repository downloads: WebToffee Gift Cards for WooCommerce","description":"Tabular values displayed in the figure \"Daily repository downloads: WebToffee Gift Cards for WooCommerce\" and its accompanying data table.\n\nOfficial daily counts for September 14-October 4, 2026, spanning the security-remediation and disclosure period. Retrieved October 19.\n\nRepository activity, not unique stores, affected installations, gift-card sales or confirmed security updates. The response does not identify downloaded versions, successful installation or exploitation. Date labels are reproduced as returned; the API does not state a reporting timezone. No missing days are filled.","inLanguage":"en","isPartOf":{"@id":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#dataset"},"isAccessibleForFree":false,"variableMeasured":[{"@type":"PropertyValue","name":"Repository-reported downloads","unitText":"downloads"}],"isBasedOn":[{"@type":"CreativeWork","name":"WordPress.org official daily plugin-download API, retrieved October19,2026","url":"https://api.wordpress.org/stats/plugin/1.0/downloads.php?slug=wt-gift-cards-woocommerce&limit=60"}]},{"@type":"NewsArticle","@id":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#article","url":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/","headline":"WebToffee fixes gift-card value validation flaw in WooCommerce plugin","description":"Version 1.3.1, released September 24, addresses a flaw that WPScan says could let unauthenticated users manipulate gift-card value and order totals.","datePublished":"2026-09-24T00:00:00.000Z","dateModified":"2026-10-19T15:37:37.093Z","inLanguage":"en","mainEntityOfPage":{"@id":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#webpage"},"isPartOf":{"@id":"https://giftcard.news/#website"},"isAccessibleForFree":false,"hasPart":[{"@type":"WebPageElement","isAccessibleForFree":false,"cssSelector":".reader-restricted"},{"@id":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#dataset"}],"image":[{"@type":"ImageObject","url":"https://giftcard.news/images/webtoffee-fixes-gift-card-value-validation-flaw-woocommerce-plugin-product-icon-ribbon.webp","contentUrl":"https://giftcard.news/images/webtoffee-fixes-gift-card-value-validation-flaw-woocommerce-plugin-product-icon-ribbon.webp","width":256,"height":256,"caption":"Official WebToffee gift-card product icon. The advisory concerns the free WooCommerce plugin identified in the report.","@id":"https://giftcard.news/images/webtoffee-fixes-gift-card-value-validation-flaw-woocommerce-plugin-product-icon-ribbon.webp#image","encodingFormat":"image/webp","description":"WebToffee gift-card product icon with a card and ribbon on a blue background","creditText":"WebToffee","isBasedOn":"https://www.webtoffee.com/product/woocommerce-gift-cards/"}],"articleSection":"Fraud & Security","keywords":["Berke Bodur","WPScan","WebToffee"],"mentions":[{"@type":"Person","@id":"https://giftcard.news/person/berke-bodur/#entity","name":"Berke Bodur","url":"https://giftcard.news/person/berke-bodur/"},{"@type":"Organization","@id":"https://giftcard.news/organization/wpscan-organization-bcb1fed4/#entity","name":"WPScan","url":"https://giftcard.news/organization/wpscan-organization-bcb1fed4/"},{"@type":"Organization","@id":"https://giftcard.news/company/webtoffee/#entity","name":"WebToffee","url":"https://giftcard.news/company/webtoffee/"}],"wordCount":554,"citation":[{"@type":"CreativeWork","name":"[S01] Original vulnerability disclosure and affected-version scope","url":"https://wpscan.com/vulnerability/998db4a0-693c-4701-a37e-ec33002e1417/","publisher":{"@type":"Organization","name":"WPScan"}},{"@type":"CreativeWork","name":"[S02] Vendor plugin description and September 24 security-fix changelog","url":"https://wordpress.org/plugins/wt-gift-cards-woocommerce/","publisher":{"@type":"Organization","name":"WebToffee via WordPress.org"}},{"@type":"CreativeWork","name":"[S03] Separate premium product and company context","url":"https://www.webtoffee.com/product/woocommerce-gift-cards/","publisher":{"@type":"Organization","name":"WebToffee"}},{"@type":"CreativeWork","name":"[S04] WPScan-assigned CVE record and affected-version scope","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91020.json","publisher":{"@type":"Organization","name":"CVE Program / WPScan"}},{"@type":"CreativeWork","name":"[S05] Complete vendor release chronology, including September24 security fix","url":"https://plugins.svn.wordpress.org/wt-gift-cards-woocommerce/trunk/changelog.txt","publisher":{"@type":"Organization","name":"WebToffee via WordPress.org SVN"}},{"@type":"CreativeWork","name":"[S06] Original daily repository-download series","url":"https://api.wordpress.org/stats/plugin/1.0/downloads.php?slug=wt-gift-cards-woocommerce&limit=60","publisher":{"@type":"Organization","name":"WordPress.org"}}],"author":[{"@id":"https://giftcard.news/author/oliver-reed/#person"}],"publisher":{"@id":"https://giftcard.news/#publisher"}},{"@type":"WebPage","@id":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#webpage","url":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/","name":"WebToffee fixes gift-card value validation flaw in WooCommerce plugin","description":"Version 1.3.1, released September 24, addresses a flaw that WPScan says could let unauthenticated users manipulate gift-card value and order totals.","datePublished":"2026-09-24T00:00:00.000Z","dateModified":"2026-10-19T15:37:37.093Z","inLanguage":"en","isPartOf":{"@id":"https://giftcard.news/#website"},"mainEntity":{"@id":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#article"},"breadcrumb":{"@id":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#breadcrumbs"},"primaryImageOfPage":{"@id":"https://giftcard.news/images/webtoffee-fixes-gift-card-value-validation-flaw-woocommerce-plugin-product-icon-ribbon.webp#image"}},{"@type":"BreadcrumbList","@id":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/#breadcrumbs","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://giftcard.news/"},{"@type":"ListItem","position":2,"name":"Fraud & Security","item":"https://giftcard.news/fraud-security/"},{"@type":"ListItem","position":3,"name":"WebToffee fixes gift-card value validation flaw in WooCommerce plugin","item":"https://giftcard.news/fraud-security/webtoffee-woocommerce-gift-card-value-validation-fix-cve-2026-91020/"}]}]} ```