bLoyal WordPress Plugin CVE-2026-15001

Exploitation requires a valid WordPress account at Subscriber level or higher on a site running the bLoyal plugin in any version through 3.1.611.78. The first phase (API URL overwrite) requires this authenticated session to reach admin-ajax.php. The second phase (authentication trigger) is entirely unauthenticated and reachable by any network client via the /cart REST route - meaning once the URL is poisoned, even a third party without a WordPress account could trigger the authentication of an arbitrary user. The plugin must be active (not merely installed) for the AJAX handlers and REST route to be registered. No non-default plugin configuration is required; the vulnerable handlers are registered unconditionally on plugin load. Exploitation is limited to sites where an attacker can obtain any subscriber-level account - self-registration is commonly enabled on WooCommerce and retail-oriented WordPress sites, which are bLoyal's primary deployment context. The only meaningful limiting factor is the requirement for that initial subscriber account; sites with closed registration and no untrusted users are not directly exploitable remotely.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects real-world risk - PR:L captures the required subscriber-level account, AC:L correctly reflects that the two-phase exploit is deterministic and requires no special timing or race conditions, and full C/I/A impact is appropriate since administrator account takeover grants complete control over the WordPress installation. The attack chain involves two distinct steps (reconfigure then trigger), which adds marginal friction compared to a single-step exploit but does not materially raise complexity. EPSS data was not provided, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV, and no public POC has been identified at time of analysis. However, the low privilege requirement combined with the prevalence of open subscriber registration on WooCommerce and loyalty-focused WordPress sites - precisely the deployment context bLoyal targets - means exploitability is high wherever an attacker can obtain any valid account.

An attacker registers a free subscriber account on a WordPress site running bLoyal 3.1.611.78 or earlier, then issues POST requests to admin-ajax.php invoking save_bloyal_configuration_data to overwrite bloyal_custom_loyaltyengine_api_url with a server they control, which is configured to return a JSON response containing the WordPress user ID of the site administrator as Customer.ExternalId. The attacker then makes an unauthenticated GET request to the public /cart REST endpoint, causing the plugin to invoke bloyal_customer_auto_login, fetch from the attacker-controlled URL, and call wp_set_auth_cookie() with the administrator's user ID - yielding a fully authenticated administrator session cookie. No public POC has been identified, but the attack is mechanically straightforward given the confirmed source code references.