WordPress Points and Rewards for WooCommerce plugin < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation vulnerability

Subscriber+ Arbitrary Points and Wallet Balance Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin Points and Rewards for WooCommerce versions 2.10.4...

CVE-2026-93510 Points and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_points

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...

CVE-2026-93510

The Points and Rewards for WooCommerce WordPress plugin (versions before 2.10.4 ) is vulnerable to an arbitrary points and wallet balance manipulation. The root cause is a failure to validate the claimed reward amount or restrict access to the Win Wheel claim handler . Consequently, authenticated...

CVE-2026-93510 Points and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_points

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...