Executive brief
The bLoyal loyalty plugin for WordPress allows attackers to escalate privileges to Administrator level through unprotected AJAX endpoints. An attacker with basic user access can reconfigure the plugin's API endpoint to point to their own malicious server, then trigger authentication functions to log in as any WordPress user, including the site administrator. This effectively grants full control over the website.
Technical details
The vulnerability stems from two unprotected AJAX actions (`save_bloyal_configuration_data` and `save_bloyal_accesskeyverification_data`) that lack capability and nonce verification, allowing authenticated Subscriber-level users to modify the plugin's stored API URL. The `bloyal_customer_auto_login` function then unconditionally trusts the `Customer.ExternalId` value from the configured API endpoint without validation, and calls `wp_set_auth_cookie()` with this attacker-controlled value. By redirecting the REST `/cart` route to their malicious endpoint, attackers can inject arbitrary user IDs and achieve authentication as any WordPress user, including administrators.
Affected products
- bLoyal Loyalty & Promotions up to and including 3.1.611.78
Timeline
- 2026-08-15: disclosed