CVE-2026-10628

Name of the Vulnerable Software and Affected Versions Points and Rewards for WooCommerce versions prior to 2.10.1

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can convert and drain reward points from any user into a wallet balance, exfiltrate user emails and point balances to an external Klaviyo account, overwrite the Klaviyo public API key, block or unblock users from the points system, and modify campaign banner and heading settings. The authentication nonce wps-wpr-verify-nonce is injected into all public pages via wp localize script(). Additionally, the wps wpr generate custom wallet handler is registered on the wp ajax nopriv hook, allowing unauthenticated visitors to obtain a valid nonce and exploit that specific function.

Recommendations Update to version 2.10.1 or later.