Points and Rewards for WooCommerce vulnerabilities

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler. Authenticated users with Subscriber role and above can credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet plugin is active, wallet balance.

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed. Unauthenticated attackers can arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce plugin to be active.

The Points and Rewards for WooCommerce plugin for WordPress up to version 2.10.0 has an authorization bypass vulnerability. Authenticated attackers with subscriber-level access can convert and drain any user's reward points, exfiltrate data to an external Klaviyo account, overwrite the Klaviyo API key, and block/unblock users in the points system. Additionally, unauthenticated visitors can obtain a valid nonce and exploit a specific action.