CVE-2026-10628
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The Points and Rewards for WooCommerce plugin for WordPress up to version 2.10.0 has an authorization bypass vulnerability. Authenticated attackers with subscriber-level access can convert and drain any user's reward points, exfiltrate data to an external Klaviyo account, overwrite the Klaviyo API key, and block/unblock users in the points system. Additionally, unauthenticated visitors can obtain a valid nonce and exploit a specific action.
Risk Assessment
The organization faces theft of reward points, leakage of user data (emails and point balances), and manipulation of plugin settings, potentially leading to financial losses and privacy breaches.
Recommendation
Immediately update the Points and Rewards for WooCommerce plugin to the latest available version. If an update is not possible, consider temporarily disabling the plugin until a patch is released.
Other vulnerabilities in Points and Rewards for WooCommerce
See all- CVE-2026-93510Medium
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler. Authenticated users with Subscriber role and above can credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet plugin is active, wallet balance.
- CVE-2026-11782Medium
The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed. Unauthenticated attackers can arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce plugin to be active.
Original NVD description (English source)
The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to convert and drain any user's reward points into wallet balance, exfiltrate all users' emails and point balances to an attacker-controlled Klaviyo account, overwrite the site's Klaviyo public API key, block or unblock arbitrary users from the points system, and modify campaign banner and heading settings. The nonce used for authentication of these requests (wps-wpr-verify-nonce) is injected into every public-facing page via wp_localize_script(), and the wps_wpr_generate_custom_wallet handler is additionally registered on the wp_ajax_nopriv_ hook, meaning unauthenticated visitors can also obtain a valid nonce and exploit that specific action.