CVE-2026-93510
MediumCVSS 4.3Summary
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler. Authenticated users with Subscriber role and above can credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet plugin is active, wallet balance.
Risk Assessment
Any logged-in user can generate unlimited loyalty points and wallet balance, leading to financial abuse and losses for the organization. The issue affects even low-privileged accounts, significantly increasing the attack surface.
Recommendation
Update the Points and Rewards for WooCommerce plugin to version 2.10.4 or later. Additionally, consider auditing awarded points and wallet balances to detect abuse.
Other vulnerabilities in Points and Rewards for WooCommerce
See all- CVE-2026-11782Medium
The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed. Unauthenticated attackers can arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce plugin to be active.
- CVE-2026-10628Medium
The Points and Rewards for WooCommerce plugin for WordPress up to version 2.10.0 has an authorization bypass vulnerability. Authenticated attackers with subscriber-level access can convert and drain any user's reward points, exfiltrate data to an external Klaviyo account, overwrite the Klaviyo API key, and block/unblock users in the points system. Additionally, unauthenticated visitors can obtain a valid nonce and exploit a specific action.
Original NVD description (English source)
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.