# Can buy Atavist Magazine subscription for free

Atavist gift-subscription API returned an error for missing payment source but still emailed a valid gift link, granting free $25 membership.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: bugra
- Disclosed: 2020-11-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/951230
- Library page: https://bugbountylibrary.com/r/h1%3A951230
- Tags: area:web3 domain:web impact:funds-loss kind:bounty platform:hackerone sev:high tech:payment technique:source-review vuln:access-control vuln:business-logic

**Target:** POST /api/v2/store/purchase.php gift purchase endpoint
**Root cause:** The purchase endpoint sends the gift email/link before (or regardless of) confirming the payment source is attached, so a failed payment still yields a redeemable gift.
**Steps:**
1. Send `POST /api/v2/store/purchase.php` with `email`, `password`, `product_id=com.theatavist.atavist.subscription.membership`, `gift_timestamp`, `gift_recipient`, `gift_message`, `gift_gifter` without any credit card on the account.
2. Observe response `{"error":"invalid_request_error","error_description":"The customer must have an active payment source attached."}`.
3. Check the recipient email inbox: a gift email with a valid gift link is delivered.
4. Redeem the gift link to obtain the $25 membership for free.
**How found:** Researcher explored the gift feature on the magazine site and noticed the gift email was still delivered even though the API returned a payment-source error.
**Exploitation:** Attacker with a free account and no payment method submits the gift purchase request; despite the payment error, the recipient receives a working gift link, which is redeemed for a paid membership at no cost.
**Insight:** On gift/transfer flows, test whether the notification or redeemable token is issued before payment authorization completes; error responses don't guarantee side effects were rolled back.