EUVD-2026-43123
GHSA-rv47-ph67-qh37
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLoad public store page
-
DeliveryExtract wps-wpr-verify-nonce from JS globals
-
ExploitPOST to admin-ajax.php with nopriv wallet action
-
ExecutionConvert victim points to wallet balance
-
Persist(Optional) Authenticate as subscriber
-
ImpactOverwrite Klaviyo API key and exfiltrate all user emails
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The wps_wpr_generate_custom_wallet action requires no authentication - it is registered on wp_ajax_nopriv_ and the required nonce is embedded in every public-facing page via wp_localize_script(), meaning any unauthenticated site visitor who can load a single page can obtain a valid nonce and call this action. All other affected actions (point-to-wallet conversion for arbitrary users, Klaviyo email exfiltration, Klaviyo API key overwrite, user block/unblock, campaign settings modification) require a valid WordPress session at subscriber level or above - any registered customer account qualifies. Limiting conditions: the plugin must be installed and active, WooCommerce must be present, and for the Klaviyo exfiltration actions the site must have Klaviyo integration configured. The unauthenticated vector is not blocked by standard WordPress login requirements because the wp_ajax_nopriv_ registration explicitly bypasses them. |
| Impact | The NVD-assigned CVSS score of 4.3 (PR:L, C:N, I:L) materially understates risk in two ways. First, the assigned C:N conflicts directly with the description, which documents exfiltration of all users' email addresses and point balances to an attacker-controlled external account - a clear confidentiality impact at minimum C:L. Second, the PR:L metric does not capture the fully unauthenticated exploitation path for wps_wpr_generate_custom_wallet; any anonymous visitor can drain points without logging in, making PR:N the accurate metric for that action path. Re-assessed with the worst exploitable conditions (unauthenticated wallet drain plus authenticated subscriber email exfiltration), the realistic severity is closer to 5.4-6.5. There is no EPSS score or KEV listing provided, and no public proof-of-concept exploit is identified in the input data - however, the attack requires no special tooling, just an HTTP request with a publicly visible nonce, making it effectively automatable against any vulnerable WooCommerce store. The financial fraud angle (point draining) and the data-redirect angle (Klaviyo API key overwrite) represent distinct harm vectors that defenders should treat separately when assessing business impact. |
| Exploit ScenarioDerived | An unauthenticated attacker loads any public page of a vulnerable WooCommerce store, extracts the wps-wpr-verify-nonce value from the page's JavaScript globals, and issues a crafted POST request to wp-admin/admin-ajax.php with action=wps_wpr_generate_custom_wallet targeting a victim user's account - converting their accumulated reward points to spendable wallet balance. A subscriber-level attacker (e.g., a customer account) can additionally call the Klaviyo export handler to redirect all registered users' email addresses and point balances to an attacker-controlled Klaviyo list, and overwrite the store's Klaviyo API key to intercept future marketing data. No exploit code beyond a basic HTTP client is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 11, 2026
Authorization bypass in Points and Rewards for WooCommerce (all versions through 2.10.0) allows authenticated subscribers to drain any user's reward points into a wallet balance, exfiltrate all user emails and point balances to an attacker-controlled Klaviyo account, and overwrite the site's Klaviyo API key - compounding financial fraud with third-party data exfiltration. Critically, the plugin exposes its authentication nonce (wps-wpr-verify-nonce) on every public-facing page via wp_localize_script(), and the wallet-draining handler is registered on the wp_ajax_nopriv_ hook, meaning the most financially damaging action - converting points to wallet balance - is exploitable by unauthenticated visitors. No public exploit code or CISA KEV listing identified at time of analysis.
RemediationAI
Upstream fix: commit 3602815 in the WordPress plugin Subversion repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3602815%40points-and-rewards-for-woocommerce&new=3602815%40points-and-rewards-for-woocommerce) contains the patch; however, a specific released patched version number is not confirmed from available data - verify the current release version on WordPress.org and update to the latest available version beyond 2.10.0. If immediate patching is not possible, a targeted workaround is to block unauthenticated AJAX requests to wp-admin/admin-ajax.php with the action=wps_wpr_generate_custom_wallet parameter at the WAF or web server layer, which addresses the highest-severity unauthenticated path; note this does not close the authenticated subscriber abuse paths. Additionally, rotate the Klaviyo public API key in site settings and audit the configured Klaviyo account for unauthorized list membership or API key changes to assess whether exploitation has already occurred. Restricting site access to authenticated users only (if business requirements permit) would eliminate the nopriv exploitation path entirely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is the WP Swings 'Points and Rewards for WooCommerce' WordPress plugin (CPE: cpe:2.3:a:wpswings:points_and_rewards_for_woocommerce:*:*:*:*:*:*:*:*), a WooCommerce loyalty system add-on. The root cause is CWE-862 (Missing Authorization): AJAX handlers performing privileged operations - user point manipulation, Klaviyo API key overwrite, user blocking, and campaign settings modification - do not verify whether the requesting user holds the capability required to perform those operations. WordPress nonces are intended as CSRF tokens, not access-control mechanisms; the plugin misuses the nonce wps-wpr-verify-nonce as a substitute for capability checks. Because wp_localize_script() embeds this nonce into every rendered page, any site visitor can extract it from the HTML source. Additionally, the wps_wpr_generate_custom_wallet handler is registered under the wp_ajax_nopriv_ hook (public/class-points-rewards-for-woocommerce-public.php#L3493), which WordPress routes without requiring login, eliminating even the subscriber authentication barrier for that specific action. The admin-side handlers (admin/class-points-rewards-for-woocommerce-admin.php lines 2568, 1814, 2657) similarly lack capability verification.
Know when Points And Rewards For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L reflects the subscriber-level path covering data exfiltration; C:L corrects the erroneous C:N given documented email and balance exfiltration; unauthenticated wallet drain is a separate, more severe sub-vector.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to convert and drain any user's reward points into wallet balance, exfiltrate all users' emails and point balances to an attacker-controlled Klaviyo account, overwrite the site's Klaviyo public API key, block or unblock arbitrary users from the points system, and modify campaign banner and heading settings. The nonce used for authentication of these requests (wps-wpr-verify-nonce) is injected into every public-facing page via wp_localize_script(), and the wps_wpr_generate_custom_wallet handler is additionally registered on the wp_ajax_nopriv_ hook, meaning unauthenticated visitors can also obtain a valid nonce and exploit that specific action.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated integrity corruption in Points and Rewards for WooCommerce (versions before 2.10.1) allows remote attack
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.5.0. Rated medium severity (CVSS 6.5
Exploit-DB