EUVD-2026-58841
GHSA-5h38-4j4g-wf4g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L reflects the required subscriber account; AC:L because the two-phase exploit is deterministic; full C/I/A because admin takeover grants complete site control.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions save_bloyal_configuration_data and save_bloyal_accesskeyverification_data being registered without any capability or nonce checks, and the bloyal_customer_auto_login function unconditionally trusting the Customer.ExternalId value returned by whichever API URL is stored in the plugin's options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's bLoyal Loyalty Engine API URL (bloyal_custom_loyaltyengine_api_url) and the is_bloyal_custom_api_url flag via the unprotected AJAX actions, then trigger the unauthenticated /cart REST route to cause bloyal_customer_auto_login to fetch customer data from an attacker-controlled endpoint and call wp_set_auth_cookie() with an attacker-supplied Customer.ExternalId, thereby authenticating as any WordPress user including the site Administrator.
AnalysisAI
Privilege escalation in the bLoyal: Loyalty & Promotions WordPress plugin allows any subscriber-level authenticated user to overwrite the plugin's configured Loyalty Engine API URL via unprotected AJAX actions, then trigger an unauthenticated REST route to force the plugin to authenticate against an attacker-controlled server and invoke wp_set_auth_cookie() with an arbitrary WordPress user ID, yielding full administrator access. All plugin versions through 3.1.611.78 are affected across every WordPress installation running the plugin. No public exploit code identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low barrier to entry - any subscriber account suffices - elevates practical risk significantly on sites with open registration.
Technical ContextAI
The vulnerability is classified as CWE-269 (Improper Privilege Management) and affects the bLoyal WordPress plugin (CPE: cpe:2.3:a:connectordev:bloyal). The root cause is a two-pronged design failure. First, the AJAX handlers save_bloyal_configuration_data and save_bloyal_accesskeyverification_data are registered without WordPress capability checks or nonce verification - the standard authorization primitives for privileged AJAX actions - meaning any authenticated session can invoke them and modify plugin options, including the Loyalty Engine API URL stored in bloyal_custom_loyaltyengine_api_url and the is_bloyal_custom_api_url flag. Second, the bloyal_customer_auto_login function, invoked from the publicly accessible /cart REST route, unconditionally trusts the Customer.ExternalId field returned by whichever API endpoint is currently stored in plugin options, passing it directly to wp_set_auth_cookie() without validation. Source code evidence is pinned to specific lines in the 3.1.611.78 tag: class-bloyalcontroller.php at L421, L2429, L2470, L2512, and L806, and bloyal.php at L1196, L1553, and L1596.
RemediationAI
No patched version has been confirmed in available data - the highest tagged release in all references is 3.1.611.78, which remains the affected version. Site administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ba4b58ad-97b3-482a-bf24-1fa85d6ef93d and the WordPress plugin repository for a new release, then upgrade immediately upon availability. As the primary interim compensating control, deactivate or delete the bLoyal plugin entirely until a patch is released; this eliminates the attack surface entirely at the cost of losing loyalty and promotions functionality. If the plugin cannot be deactivated, restrict WordPress user registration to prevent untrusted users from obtaining subscriber accounts, since the first phase of the attack requires a valid authenticated session. A WAF rule blocking POST requests to admin-ajax.php with action values of save_bloyal_configuration_data or save_bloyal_accesskeyverification_data from non-administrator sessions provides an additional layer, though this may interfere with legitimate plugin administration if subscribers are expected to use those actions. Blocking unauthenticated access to the /cart REST endpoint at the WAF or server level disrupts the second phase of the attack but may break legitimate cart functionality for anonymous shoppers.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today