CVE-2026-11782

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated...

PT-2026-66365

Name of the Vulnerable Software and Affected Versions Points and Rewards for WooCommerce versions prior to 2.10.1 Description An Insecure Direct Object Reference IDOR exists due to missing authorization checks and validation on a user-controlled key during a wallet and points update action. This...