A race condition vulnerability exists in YITH WooCommerce Gift Cards WordPress plugin versions before 4.38.1. The plugin does not properly lock or atomically update gift card balances during redemption at checkout. This flaw allows an attacker who possesses a gift card code to spend more than the card's funded value by submitting multiple simultaneous checkouts using the same code.