PatchSiren cyber security CVE debrief
CVE-2026-10628 wpswings CVE debrief
The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to convert and drain any user's reward points into wallet balance, exfiltrate all users' emails and point balances to an attacker-controlled Klaviyo account, overwrite the site's Klaviyo public API key, block or unblock arbitrary users from the points system, and modify campaign banner and heading settings.
- Vendor
- wpswings
- Product
- Points and Rewards for WooCommerce
- CVSS
- MEDIUM 4.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-11
- Original CVE updated
- 2026-07-11
- Advisory published
- 2026-07-11
- Advisory updated
- 2026-07-11
Who should care
Administrators of WordPress sites using the Points and Rewards for WooCommerce plugin, especially those with subscriber-level access or above, should be aware of this vulnerability and take immediate action to protect their sites.
Technical summary
The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to improper verification of user authorization. This allows authenticated attackers with subscriber-level access and above to perform various malicious actions, including converting and draining reward points, exfiltrating user emails and point balances, overwriting Klaviyo API keys, and modifying site settings.
Defensive priority
High
Recommended defensive actions
- Update the Points and Rewards for WooCommerce plugin to a version that fixes the authorization bypass vulnerability.
- Restrict access to sensitive plugin settings and features.
- Monitor site activity for suspicious behavior related to reward points and Klaviyo integration.
- Consider implementing additional security measures, such as two-factor authentication and regular security audits.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
Evidence notes
The CVE record was published on 2026-07-11T04:17:02.733Z and has not been modified since then. The NVD entry is currently in the 'Received' status. Evidence is limited to CVE and NVD details. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-11T04:17:02.733Z and has not been modified since then.