EUVD-2026-85062

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...

PT-2026-97199

Name of the Vulnerable Software and Affected Versions Points and Rewards for WooCommerce WordPress plugin versions prior to 2.10.4 Description Authenticated users with Subscriber privileges or higher can credit their own accounts with an unlimited amount of loyalty points. This occurs because the...

Loyalty points fraud is funding hacker holidays (Lock and Code S07E18)

This week on the Lock and Code podcast… Crooks are taking a holiday. They’re counting on you to fund it. For decades, cybercriminals have stolen roughly the same types of data. Biographical and personal details—like Social Security numbers, birthdates, addresses, and phone numbers—can be stolen t...

WordPress ShopSmart Loyalty for WooCommerce plugin <= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart_check_phone vulnerability

Unauthenticated Sensitive Information Disclosure via shopsmartcheckphone vulnerability discovered by Pedro Pinho in WordPress Plugin ShopSmart Loyalty for WooCommerce versions = 1.0.0...

CVE-2026-14832

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name,...

CVE-2026-14832 ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart_check_phone

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name,...

EUVD-2026-60056

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name,...

CVE-2026-14832

The ShopSmart Loyalty for WooCommerce WordPress plugin (versions

CVE-2026-14832 ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart_check_phone

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name,...

CVE-2026-14832

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name,...

CVE-2026-14832: Authorization Bypass Through User-Controlled Key

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name,...

PT-2026-73210

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name,...

CVE-2026-15001: Improper Privilege Management

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

CVE-2026-11782

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated...

CVE-2026-11782 Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated...

EUVD-2026-51002

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated...

CVE-2026-11782

The Points and Rewards for WooCommerce WordPress plugin (versions before 2.10.1 ) contains an Insecure Direct Object Reference (IDOR) vulnerability. The plugin lacks authorization checks on a wallet and points update action accessible to unauthenticated users , and it fails to verify account owne...

CVE-2026-11782

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated...

PT-2026-66365

Name of the Vulnerable Software and Affected Versions Points and Rewards for WooCommerce versions prior to 2.10.1 Description An Insecure Direct Object Reference IDOR exists due to missing authorization checks and validation on a user-controlled key during a wallet and points update action. This...

CVE-2026-11782: Improper Access Control

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated...