CVE-2026-93510 Points and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_points

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...

CVE-2026-93510 Points and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_points

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...

WordPress Points and Rewards for WooCommerce plugin < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation vulnerability

Subscriber+ Arbitrary Points and Wallet Balance Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin Points and Rewards for WooCommerce versions 2.10.4...

CVE-2026-93510

The Points and Rewards for WooCommerce WordPress plugin (versions before 2.10.4 ) is vulnerable to an arbitrary points and wallet balance manipulation. The root cause is a failure to validate the claimed reward amount or restrict access to the Win Wheel claim handler . Consequently, authenticated...

CVE-2026-77764

The GamiPress WordPress plugin, in versions prior to 7.9.9.6 , contains an authorization bypass vulnerability in its video watch-tracking functionality . This flaw allows users with low-level privileges, such as Subscriber , to award configured gamification points, achievements, and ranks to arbi...

CVE-2026-11782 Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated...

Staker can withdraw a staked LP token amount that is small enough to ensure that lpPosition.points does not change when calling NeoTokyoStaker._withdrawLP function and cause extra reward shares, which the staker is not entitled to, to be minted to the staker when calling lpPosition.getPoolReward function later

Lines of code Vulnerability details Impact When withdrawing the staked LP tokens, the staker can divide the total staked token amount into smaller amounts and call the NeoTokyoStaker.withdraw function, which further calls the following NeoTokyoStaker.withdrawLP function, to withdraw each of such...

Mail.ru: [pandao.ru] Возможность списания несуществующих бонусных баллов

Race condition TOCTOU in pandao.ru marketplace allowed to use bonus points more than once. On the time of reporting, pandao.ru runs temporary pre-bug bounty competition program with $1000 bounties for vulnerabilities related to money/points/orders manipulation...