CVE-2026-11782
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed. Unauthenticated attackers can arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce plugin to be active.
Risk Assessment
An attacker can manipulate wallet balances and loyalty points, leading to financial loss and compromise of the rewards system integrity.
Recommendation
Update the Points and Rewards for WooCommerce plugin to version 2.10.1 or later.
Other vulnerabilities in Points and Rewards for WooCommerce
See all- CVE-2026-93510Medium
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler. Authenticated users with Subscriber role and above can credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet plugin is active, wallet balance.
- CVE-2026-10628Medium
The Points and Rewards for WooCommerce plugin for WordPress up to version 2.10.0 has an authorization bypass vulnerability. Authenticated attackers with subscriber-level access can convert and drain any user's reward points, exfiltrate data to an external Klaviyo account, overwrite the Klaviyo API key, and block/unblock users in the points system. Additionally, unauthenticated visitors can obtain a valid nonce and exploit a specific action.
Original NVD description (English source)
The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated attackers to arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce Points and Rewards for WooCommerce WordPress plugin before 2.10.1 to be active.