Junglewise Threat Intelligence

CVE-2026-10628: WP Swings Points and Rewards for WooCommerce authorization bypass

CVE-2026-10628 · Severity: medium · CVSS 4.3 · Published 2026-07-11

Vendors: WP Swings.

Executive brief

The Points and Rewards for WooCommerce plugin for WordPress, which manages customer loyalty programs, contains a security flaw that allows unauthorized users to manipulate reward points. Attackers can drain user point balances, exfiltrate customer email lists to external accounts, and modify site settings. This could lead to financial loss through point theft and significant privacy concerns regarding customer data.

Technical details

The vulnerability is classified as a missing authorization check (CWE-862) within several AJAX handlers. The plugin fails to verify user permissions before executing sensitive actions, such as point-to-wallet conversion and Klaviyo API key updates. While most actions require subscriber-level authentication, the 'wps_wpr_verify-nonce' is leaked on all public-facing pages via 'wp_localize_script()'. Furthermore, the 'wps_wpr_generate_custom_wallet' handler is registered via 'wp_ajax_nopriv_', potentially allowing unauthenticated visitors to exploit specific functions. Attackers can exfiltrate user data to a controlled Klaviyo account or block/unblock users from the rewards system.

Affected products

  • WP Swings Points and Rewards for WooCommerce up to, and including, 2.10.0

Timeline

  • 2026-07-11: advisory: Initial disclosure by Wordfence and NVD

References

Related threats