What is the CVSS score of CVE-2026-10628?

CVE-2026-10628 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

WooCommerce Points Rewards CVE-2026-10628

EUVD-2026-43123 MEDIUM

Missing Authorization (CWE-862)

2026-07-11 Wordfence

GHSA-rv47-ph67-qh37

WordPress Authentication Bypass Wordpress Plugin Points And Rewards For Woocommerce Wpswings

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L reflects the subscriber-level path covering data exfiltration; C:L corrects the erroneous C:N given documented email and balance exfiltration; unauthenticated wallet drain is a separate, more severe sub-vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 03:44 vuln.today

CVE Published

Jul 11, 2026 - 02:31 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to convert and drain any user's reward points into wallet balance, exfiltrate all users' emails and point balances to an attacker-controlled Klaviyo account, overwrite the site's Klaviyo public API key, block or unblock arbitrary users from the points system, and modify campaign banner and heading settings. The nonce used for authentication of these requests (wps-wpr-verify-nonce) is injected into every public-facing page via wp_localize_script(), and the wps_wpr_generate_custom_wallet handler is additionally registered on the wp_ajax_nopriv_ hook, meaning unauthenticated visitors can also obtain a valid nonce and exploit that specific action.

AnalysisAI

Authorization bypass in Points and Rewards for WooCommerce (all versions through 2.10.0) allows authenticated subscribers to drain any user's reward points into a wallet balance, exfiltrate all user emails and point balances to an attacker-controlled Klaviyo account, and overwrite the site's Klaviyo API key - compounding financial fraud with third-party data exfiltration. Critically, the plugin exposes its authentication nonce (wps-wpr-verify-nonce) on every public-facing page via wp_localize_script(), and the wallet-draining handler is registered on the wp_ajax_nopriv_ hook, meaning the most financially damaging action - converting points to wallet balance - is exploitable by unauthenticated visitors. No public exploit code or CISA KEV listing identified at time of analysis.

Technical ContextAI

The affected product is the WP Swings 'Points and Rewards for WooCommerce' WordPress plugin (CPE: cpe:2.3:a:wpswings:points_and_rewards_for_woocommerce:*:*:*:*:*:*:*:*), a WooCommerce loyalty system add-on. The root cause is CWE-862 (Missing Authorization): AJAX handlers performing privileged operations - user point manipulation, Klaviyo API key overwrite, user blocking, and campaign settings modification - do not verify whether the requesting user holds the capability required to perform those operations. WordPress nonces are intended as CSRF tokens, not access-control mechanisms; the plugin misuses the nonce wps-wpr-verify-nonce as a substitute for capability checks. Because wp_localize_script() embeds this nonce into every rendered page, any site visitor can extract it from the HTML source. Additionally, the wps_wpr_generate_custom_wallet handler is registered under the wp_ajax_nopriv_ hook (public/class-points-rewards-for-woocommerce-public.php#L3493), which WordPress routes without requiring login, eliminating even the subscriber authentication barrier for that specific action. The admin-side handlers (admin/class-points-rewards-for-woocommerce-admin.php lines 2568, 1814, 2657) similarly lack capability verification.

RemediationAI

Upstream fix: commit 3602815 in the WordPress plugin Subversion repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3602815%40points-and-rewards-for-woocommerce&new=3602815%40points-and-rewards-for-woocommerce) contains the patch; however, a specific released patched version number is not confirmed from available data - verify the current release version on WordPress.org and update to the latest available version beyond 2.10.0. If immediate patching is not possible, a targeted workaround is to block unauthenticated AJAX requests to wp-admin/admin-ajax.php with the action=wps_wpr_generate_custom_wallet parameter at the WAF or web server layer, which addresses the highest-severity unauthenticated path; note this does not close the authenticated subscriber abuse paths. Additionally, rotate the Klaviyo public API key in site settings and audit the configured Klaviyo account for unauthorized list membership or API key changes to assess whether exploitation has already occurred. Restricting site access to authenticated users only (if business requirements permit) would eliminate the nopriv exploitation path entirely.