# CVE-2026-10628: WP Swings Points and Rewards for WooCommerce authorization bypass

Source: https://junglewise.ai/threats/cve-2026-10628-wp-swings-points-and-rewards-for-woocommerce-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-11. Updated: 2026-07-11  
License: CC BY 4.0 with a link back

CVE-2026-10628 · Severity: medium · CVSS 4.3 · Published 2026-07-11

The Points and Rewards for WooCommerce plugin for WordPress, which manages customer loyalty programs, contains a security flaw that allows unauthorized users to manipulate reward points. Attackers can drain user point balances, exfiltrate customer email lists to external accounts, and modify site settings. This could lead to financial loss through point theft and significant privacy concerns regarding customer data.

Vendors: [WP Swings](https://junglewise.ai/threats/vendors/wp-swings).

## Quick answers

**Is CVE-2026-10628 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10628 being exploited in the wild.

**How severe is CVE-2026-10628?** Medium severity, with a CVSS score of 4.3, published 11 July 2026.

**Which products and versions are affected?** WP Swings Points and Rewards for WooCommerce up to, and including, 2.10.0.

**Is there a fix for CVE-2026-10628?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10628 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-10628?** Check whether you run WP Swings Points and Rewards for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as a missing authorization check (CWE-862) within several AJAX handlers. The plugin fails to verify user permissions before executing sensitive actions, such as point-to-wallet conversion and Klaviyo API key updates. While most actions require subscriber-level authentication, the 'wps_wpr_verify-nonce' is leaked on all public-facing pages via 'wp_localize_script()'. Furthermore, the 'wps_wpr_generate_custom_wallet' handler is registered via 'wp_ajax_nopriv_', potentially allowing unauthenticated visitors to exploit specific functions. Attackers can exfiltrate user data to a controlled Klaviyo account or block/unblock users from the rewards system.

## Affected products

- WP Swings Points and Rewards for WooCommerce up to, and including, 2.10.0

## Timeline

- 2026-07-11: advisory: Initial disclosure by Wordfence and NVD

## References

- [https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/admin/class-points-rewards-for-woocommerce-admin.php](https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/admin/class-points-rewards-for-woocommerce-admin.php)
- [https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/admin/class-points-rewards-for-woocommerce-admin.php](https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/admin/class-points-rewards-for-woocommerce-admin.php)
- [https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/admin/class-points-rewards-for-woocommerce-admin.php](https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/admin/class-points-rewards-for-woocommerce-admin.php)
- [https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/public/class-points-rewards-for-woocommerce-public.php](https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/public/class-points-rewards-for-woocommerce-public.php)
- [https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/public/class-points-rewards-for-woocommerce-public.php](https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/public/class-points-rewards-for-woocommerce-public.php)
- [https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.9.7/admin/class-points-rewards-for-woocommerce-admin.php](https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.9.7/admin/class-points-rewards-for-woocommerce-admin.php)
- [https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.9.7/admin/class-points-rewards-for-woocommerce-admin.php](https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.9.7/admin/class-points-rewards-for-woocommerce-admin.php)

## Related threats

- [WooCommerce Points and Rewards IDOR in wallet and points update](https://junglewise.ai/threats/cve-2026-11782-woocommerce-points-and-rewards-idor-in-wallet-and-points-update)