Missing Authorization in WooCommerce Points and Rewards <=2.10.1 via AJAX Actions (CVE-2026-10628)

Vulnerability Overview Vulnerability Name: Points and Rewards for WooCommerce <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions CVE ID: CVE-2026-10628 CVSS Score: 4.3 (Medium) Publication Date: July 10, 2026 Last Updated: July 11, 2026 Researcher: Latz Impact Scope Affected Versions: <= 2.10.1 Software Type: Plugin Software Slug: points-and-rewards-for-woocommerce Remediation Fixed Version: 2.10.2 Recommendation: Update to version 2.10.2 or higher. Vulnerability Description This vulnerability exists in the Points and Rewards for WooCommerce plugin, allowing authenticated attackers (with Subscriber level or higher privileges) to bypass authorization checks and perform arbitrary actions. Specifically, it includes: Converting other users' reward points into wallet balance Extracting all users' email addresses and wallet balances Overwriting the site's global public API key in an attacker-controlled Klaviyo account Blocking or unblocking users from the points system Modifying activity banner and title settings References plugins.trac.wordpress.org Additional Information Disclaimer: This record contains copyrighted material. Contact: For any errors or if more information is needed, please contact support@wordfence.com. Related Recent Vulnerabilities 1. Points and Rewards for WooCommerce <= 2.9.5 - Missing Authorization - CVE ID: CVE-2026-24581 - CVSS Score: 4.3 - Researcher: Rapid7 - Publication Date: January 19, 2026 2. Points and Rewards for WooCommerce <= 1.5.0 - Cross-Site Request Forgery to Settings Change - CVE ID: CVE-2023-27607 - CVSS Score: 4.3 - Researcher: Dave Jong - Publication Date: May 5, 2023 3. Points and Rewards for WooCommerce <= 1.5.0 - Missing Authorization - CVE ID: CVE-2023-27608 - CVSS Score: 6.5 - Researcher: Dave Jong - Publication Date: May 5, 2023 Summary This vulnerability involves a missing authorization issue in the Points and Rewards for WooCommerce plugin, affecting versions <= 2.10.1. Users are advised to update to version 2.10.2 or higher as soon as possible to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Missing Authorization in WooCommerce Points and Rewards <=2.10.1 via AJAX Actions (CVE-2026-10628)

More from this source