Executive brief
A vulnerability in a popular WooCommerce loyalty plugin allows unauthorized individuals to change any customer's reward points or digital wallet balance. An attacker could use this to grant themselves unlimited store credit or maliciously deplete the balances of other customers. This could lead to significant financial loss for the merchant and damage to customer trust.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) within the 'wps_wpr_generate_custom_wallet' AJAX action. The plugin fails to perform authorization checks or verify that the requester owns the account associated with the 'user_id' parameter. An unauthenticated attacker can obtain a valid nonce from the front-end and send a crafted request to 'admin-ajax.php' to modify the 'wps_wpr_points' and 'wps_wallet' meta values for any user ID. This can result in point inflation or driving wallet balances into negative values. The issue is fixed in version 2.10.1.
Affected products
- WP Swings Points and Rewards for WooCommerce < 2.10.1
- WP Swings Wallet System for WooCommerce < 2.10.1
Timeline
- 2026-07-13: disclosed: Initial public disclosure by WPScan
- 2026-07-30: advisory: NVD publication date