Read the docs
TI-2026-10169 Aliases CVE-2026-11782GHSA-8v7r-jxgc-83m5

Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR

Priority MEDIUM 60CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-284.

Summary

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated attackers to arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce Points and Rewards for WooCommerce WordPress plugin before 2.10.1 to be active.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00293 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Points and Rewards for WooCommerce (Unknown): 2.10.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownPoints and Rewards for WooCommercebefore 2.10.12.10.1Patch availableCNA
  • Points and Rewards for WooCommerce VendorUnknown Affected before 2.10.1 Fixed in 2.10.1 Patch available CNA

Remediation

  • Fix · CNA Points and Rewards for WooCommerce (Unknown) Fixed in 2.10.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11782
  2. 2026-10-03 Alias added: GHSA-8v7r-jxgc-83m5

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences