Rewardswp EUVD-2026-15884

Remote unauthenticated attacker can exploit RewardsWP plugin versions <= 1.0.4 installed on WordPress sites. No victim interaction required. Default WordPress installations with this plugin enabled are vulnerable.

While CVSS and EPSS scores are not provided in the available intelligence, the privilege escalation nature of this vulnerability presents significant real-world risk. Privilege escalation vulnerabilities are inherently high-severity because they enable attackers to bypass initial security boundaries; even an unauthenticated attacker or low-privileged user (such as a subscriber) could potentially escalate to administrator-level access. The lack of CVSS vector data prevents precise assessment of attack complexity and required privileges, but CWE-266 violations typically have low attack complexity once the weakness is discovered. The involvement of Patchstack as the reporting entity and ENISA EUVD cataloging (EUVD-2026-15884) indicate coordinated disclosure through established channels. Without confirmation of active exploitation (KEV status) or public POC availability, the actual exploitation risk depends on plugin adoption rate and time-to-patch, but privilege escalation in authentication layers should be treated as a high priority for any affected deployment.

An attacker with a low-privileged WordPress account (such as a subscriber or contributor) could exploit the privilege assignment flaw to escalate their capabilities to administrator level, potentially by manipulating reward or affiliate settings or triggering an improperly protected function that assigns higher-level capabilities without proper authorization checks. Once elevated, the attacker gains full control over affiliate/reward configurations, user data, and potentially the wider WordPress installation, enabling account hijacking, malware injection, or data exfiltration of affiliate commissions and user information.