PT-2026-97199

CVE-2026-93510

Published

2026-09-23

Updated

2026-09-23

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Points and Rewards for WooCommerce WordPress plugin versions prior to 2.10.4

Description Authenticated users with Subscriber privileges or higher can credit their own accounts with an unlimited amount of loyalty points. This occurs because the plugin fails to validate the claimed reward amount or restrict access to the Win Wheel claim handler. Additionally, if a companion wallet is active, the user can also manipulate their wallet balance.

Recommendations Update Points and Rewards for WooCommerce WordPress plugin to version 2.10.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Farid Narimanov

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers