CVE-2025-15260

Name of the Vulnerable Software and Affected Versions MyRewards – Loyalty Points and Rewards for WooCommerce plugin versions prior to 5.6.1

Description The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress does not properly verify user authorization when performing actions within the ajax function. This allows authenticated attackers with subscriber-level access or higher to modify, add, or delete loyalty program earning rules. Specifically, attackers can manipulate point multipliers to arbitrary values.

Recommendations Update the MyRewards – Loyalty Points and Rewards for WooCommerce plugin to version 5.6.1 or later.