CVE-2026-15001 connectordev CVE debrief

Who should care

WordPress site administrators and users of the bLoyal: Loyalty & Promotions by bLoyal plugin should be aware of this vulnerability and take immediate action to protect their sites.

Technical summary

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation due to unprotected AJAX actions and unconditional trust in the `Customer.ExternalId` value. This allows authenticated attackers with Subscriber-level access and above to overwrite plugin settings and authenticate as any WordPress user. Affected product deployments should review official advisories for scope, severity, and vendor guidance. Compensating controls and monitoring are recommended while remediation is scheduled and verified. The vulnerability exists in all versions up to, and including, 3.1.611.78, with a CVSS score of 8.8 and a severity of HIGH. The CVE record was published on 2026-08-15T03:16:47.393Z and has not been modified since then. To protect their sites, WordPress site administrators and users of the bLoyal: Loyalty & Promotions by bLoyal plugin should apply vendor patches or updates, monitor for suspicious activity, and restrict access to sensitive areas. The bLoyal Loyalty Engine API URL (`bloyal_custom_loyaltyengine_api_url`) and the `is_bloyal_custom_api_url` flag can be overwritten via the unprotected AJAX actions, then trigger the unauthenticated `/cart` REST route to cause `bloyal_customer_auto_login` to fetch customer data from an attacker-controlled endpoint and call `wp_set_auth_cookie()` with an attacker-supplied `Customer.ExternalId`, thereby authenticating as any WordPress user including the site Administrator. Evidence notes indicate that the CVE-2026-15001 record indicates a Privilege Escalation vulnerability in the bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress. The CVSS score is 8.8 with a severity of HIGH. The CVE record was published on 2026-08-15T03:16:47.393Z and has not been modified since then. The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions `save_bloyal_configuration_data` and `save_bloyal_accesskeyverification_data` being registered without any capability or nonce checks, and the `bloyal_customer_auto_login` function unconditionally trusting the `Customer.ExternalId` value

Defensive priority

Authenticated attackers with Subscriber-level access and above can exploit this vulnerability to overwrite the plugin's bLoyal Loyalty Engine API URL and the `is_bloyal_custom_api_url` flag, then trigger the unauthenticated `/cart` REST route to cause `bloyal_customer_auto_login` to fetch customer data from an attacker-controlled endpoint and call `wp_set_auth_cookie()` with an attacker-supplied `Customer.ExternalId`, thereby authenticating as any WordPress user including the site Administrator.

Recommended defensive actions

• Inventory and verify installed plugin versions
• Apply vendor patches or updates
• Monitor for suspicious activity
• Restrict access to sensitive areas
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-15001 record indicates a Privilege Escalation vulnerability in the bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress. The vulnerability exists in all versions up to, and including, 3.1.611.78. The CVSS score is 8.8 with a severity of HIGH.

Official resources