CVE-2026-93510

Name of the Vulnerable Software and Affected Versions Points and Rewards for WooCommerce WordPress plugin versions prior to 2.10.4

Description Authenticated users with Subscriber privileges or higher can credit their own accounts with an unlimited amount of loyalty points. This occurs because the plugin fails to validate the claimed reward amount or restrict access to the Win Wheel claim handler. Additionally, if a companion wallet is active, the user can also manipulate their wallet balance.

Recommendations Update Points and Rewards for WooCommerce WordPress plugin to version 2.10.4 or later.