CVE-2026-11782

Name of the Vulnerable Software and Affected Versions Points and Rewards for WooCommerce versions prior to 2.10.1

Description An Insecure Direct Object Reference (IDOR) exists due to missing authorization checks and validation on a user-controlled key during a wallet and points update action. This allows unauthenticated attackers to arbitrarily modify or corrupt the stored wallet balance and loyalty points of any user, including driving the balance negative. Modifying the wallet balance specifically requires the Wallet System for WooCommerce companion plugin to be active.

Recommendations Update Points and Rewards for WooCommerce to version 2.10.1 or later.