Latz

**Name of the Vulnerable Software and Affected Versions** Points and Rewards for WooCommerce versions prior to 2.10.1 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can convert and drain reward points from any user into a wallet balance, exfiltrate user emails and point balances to an external Klaviyo account, overwrite the Klaviyo public API key, block or unblock users from the points system, and modify campaign banner and heading settings. The authentication nonce `wps-wpr-verify-nonce` is injected into all public pages via `wp localize script()`. Additionally, the `wps wpr generate custom wallet` handler is registered on the `wp ajax nopriv ` hook, allowing unauthenticated visitors to obtain a valid nonce and exploit that specific function. **Recommendations** Update to version 2.10.1 or later.