Vulnerability in Points And Rewards For Woocommerce
CVE-2026-11782
The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated attackers to arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce Points and Rewards for WooCommerce WordPress plugin before 2.10.1 to be active.
EPSS: 0.002 (12.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Unknown Points And Rewards For Woocommerce — versions 0
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-11782?
- CVE-2026-11782 is a medium-severity vulnerability in Points And Rewards For Woocommerce, classified under Improper Access Control. CVSS score: 5.9/10. Published 2026-07-30.
- How severe is CVE-2026-11782?
- Medium severity. CVSS v3 base score is 5.9 out of 10.