WooCommerce Rewards Plugin CVE-2026-11782

The Points and Rewards for WooCommerce plugin (version < 2.10.1) must be installed and active on the WordPress/WooCommerce site. For loyalty points manipulation alone, only this one plugin is required to be present. For wallet balance corruption, the companion Wallet System for WooCommerce Points and Rewards plugin (also version < 2.10.1) must additionally be installed and active - this is an explicit secondary condition stated in the description. The CVSS PR:N confirms no authentication is required by the attacker. However, the AC:H rating and SSVC 'Automatable: no' judgment indicate that the attacker must supply a valid, known target user account identifier (such as a WordPress user ID or similar reference); blind or fully automated mass exploitation across unknown accounts is constrained by this requirement. Exploitation is limited to integrity impact on WooCommerce user data - no code execution, no credential theft.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) rates this at 5.9 (Medium). The AC:H designation is notable - despite the absence of authentication requirements, SSVC also flags it as 'Automatable: no', which together suggest that successful exploitation requires knowledge of a valid target user's account identifier (e.g., user ID or email), preventing fully blind mass exploitation. This is a real constraint worth weighting. EPSS at 0.15% (4th percentile) is very low, indicating minimal observed exploitation probability, despite a public POC existing. The SSVC assessment of 'Technical Impact: partial' aligns with the bounded CIA impact (integrity-only, scoped to WooCommerce user data). The practical business risk to an e-commerce operator is meaningful: an attacker who can inflate their own points or wallet could fraudulently redeem discounts, drain store margins, or destroy competitor-account loyalty balances. This makes it a higher priority for WooCommerce store operators specifically than the CVSS score alone implies. One discrepancy: the input tags include 'Information Disclosure', but neither the description nor the CVSS vector (C:N) supports any confidentiality impact - this tag appears to be erroneous and should not influence triage.

An unauthenticated attacker, aware of the public PoC documented by WPScan, identifies a WooCommerce store running the vulnerable plugin by probing for known plugin file paths. The attacker then enumerates or guesses a target user's WordPress account identifier and submits a crafted unauthenticated HTTP request to the plugin's update action, inflating their own loyalty points to maximum value or zeroing out a competitor customer's wallet balance - enabling fraudulent reward redemptions without purchasing goods.