Security Alert Summary
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 contains a vulnerability in its Win Wheel claim handler that does not validate the claimed reward amount or restrict who can call the handler. Authenticated users with Subscriber-level access or higher can credit arbitrary and unlimited loyalty points to their own account and, if a companion wallet plugin is active, increase their wallet balance.
CVE Details
- CVE ID: CVE-2026-93510
- Affected component: Points and Rewards for WooCommerce WordPress plugin
- Affected versions: Versions before 2.10.4
- Published: September 23, 2026 at 6:17:06 AM (time as provided)
- Last modified: September 23, 2026 at 11:17:18 AM (time as provided)
- CVSS v3.1: Base Score 4.3, Severity MEDIUM
- CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction: Privileges Required: LOW (authenticated user, e.g., Subscriber); User Interaction: NONE; Attack Vector: NETWORK; Attack Complexity: LOW
- Primary impact: Confidentiality: NONE; Integrity: LOW (unauthorized modification of loyalty points and, where applicable, wallet balance); Availability: NONE
- Weakness: CWE-862 (Missing Authorization)
Technical Details
The plugin fails to validate the claimed reward amount and does not restrict access to its Win Wheel claim handler. Because the claim handler can be invoked by authenticated users with low privileges, attackers or legitimate users with Subscriber-level access or higher can call the handler to credit an arbitrary and unlimited number of loyalty points to their account. When a companion wallet integration for the Points and Rewards plugin is active, the same flaw can result in increases to the wallet balance.
This is a missing authorization and input validation issue: the handler does not enforce proper permission checks to ensure only intended roles or trusted requests can award points, nor does it validate or cap the reward amount parameter. The result is an integrity impact limited to manipulation of point balances and wallet balances; there is no CVSS-indicated confidentiality or availability impact in the provided data.
How This Could Impact Your Website
Consider a site with an owner, internal staff (editors or shop managers), and external contributors or contractors who have Subscriber or higher accounts. An authenticated contributor could call the vulnerable claim handler and add large amounts of loyalty points to their own account. If your site uses points for discounts, purchases, or a wallet feature, this can allow manipulation of store credits or discounts without authorization.
Practical consequences include increased risk of fraud (unauthorized discounts or credits) and potential financial loss from redeemed points. While the CVSS data indicates no direct confidentiality impact, unauthorized inflation of point balances can facilitate targeted social engineering or fraud attempts aimed at staff or contractors associated with high-value accounts. If you re-use credentials or have weak role separation, this type of abuse may be easier to exploit.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Subscriber-plus roles that can interact with commerce features.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins, and audit any companion wallet or rewards integrations.
- Monitor site activity and transaction logs for unusual point grants, wallet top-ups, or redemption patterns.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
