CVE-2026-15001
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
The bLoyal plugin for WordPress up to version 3.1.611.78 is vulnerable to privilege escalation. The AJAX actions save_bloyal_configuration_data and save_bloyal_accesskeyverification_data lack capability and nonce checks, and the bloyal_customer_auto_login function unconditionally trusts the Customer.ExternalId value from the API URL. Authenticated attackers with Subscriber-level access can overwrite the API URL and log in as any user, including administrator.
Risk Assessment
A user with minimal privileges can take over an administrator account, leading to complete site compromise.
Recommendation
Update the bLoyal plugin to the latest patched version. Restrict access to AJAX actions to trusted users only.
Original NVD description (English source)
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions `save_bloyal_configuration_data` and `save_bloyal_accesskeyverification_data` being registered without any capability or nonce checks, and the `bloyal_customer_auto_login` function unconditionally trusting the `Customer.ExternalId` value returned by whichever API URL is stored in the plugin's options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's bLoyal Loyalty Engine API URL (`bloyal_custom_loyaltyengine_api_url`) and the `is_bloyal_custom_api_url` flag via the unprotected AJAX actions, then trigger the unauthenticated `/cart` REST route to cause `bloyal_customer_auto_login` to fetch customer data from an attacker-controlled endpoint and call `wp_set_auth_cookie()` with an attacker-supplied `Customer.ExternalId`, thereby authenticating as any WordPress user including the site Administrator.