EUVD-2026-51002
GHSA-8v7r-jxgc-83m5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable unauthenticated endpoint; AC:H because exploiting a specific user requires a valid account identifier; integrity-only impact with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated attackers to arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce Points and Rewards for WooCommerce WordPress plugin before 2.10.1 to be active.
AnalysisAI
Unauthenticated integrity corruption in Points and Rewards for WooCommerce (versions before 2.10.1) allows remote attackers to arbitrarily modify or corrupt the wallet balance and loyalty points of any user account - including driving values negative - without possessing any credentials. The missing authorization check on a wallet/points update action fails to verify that the requester owns the targeted account, making cross-account manipulation trivially possible. A publicly available proof-of-concept exists per WPScan; the vulnerability is not currently listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), suggesting exploitation has not yet been observed at scale.
Technical ContextAI
The vulnerability is rooted in CWE-284 (Improper Access Control): the plugin exposes an action endpoint - accessible without authentication - that updates wallet balances and loyalty point totals without performing ownership or capability checks. This is a classic WordPress plugin authorization failure, where an AJAX or REST handler lacks a nonce check, capability check (current_user_can()), or account ownership assertion before modifying user meta. The affected CPE is cpe:2.3:a:unknown:points_and_rewards_for_woocommerce:*:*:*:*:*:*:*:*, covering all versions prior to 2.10.1. Wallet balance corruption specifically requires the companion 'Wallet System for WooCommerce Points and Rewards for WooCommerce' plugin (also before 2.10.1) to be installed and active, since this secondary plugin provides the wallet storage layer. Loyalty points manipulation is possible with the primary plugin alone.
RemediationAI
Update the Points and Rewards for WooCommerce plugin to version 2.10.1 or later; this is the vendor-released patch and is the primary fix. If the Wallet System for WooCommerce companion plugin is also installed, it must be independently updated to version 2.10.1 or later, as the wallet balance attack surface requires both plugins to be affected. Advisory reference: https://wpscan.com/vulnerability/a1089e94-ecc7-458e-97f6-48bd809192ef/. If immediate patching is not feasible, a compensating control is to temporarily deactivate both affected plugins - this eliminates the exposed endpoint but also disables all loyalty and wallet functionality for customers. Restricting access to WordPress AJAX endpoints (wp-admin/admin-ajax.php) via WAF rules for unauthenticated requests referencing the affected action name is a narrower workaround but requires knowing the specific action parameter, which the WPScan PoC may disclose.
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.5.0. Rated medium severity (CVSS 6.5
Authorization bypass in Points and Rewards for WooCommerce (all versions through 2.10.0) allows authenticated subscriber
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today