PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10628 wpswings CVE debrief

The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to convert and drain any user's reward points into wallet balance, exfiltrate all users' emails and point balances to an attacker-controlled Klaviyo account, overwrite the site's Klaviyo public API key, block or unblock arbitrary users from the points system, and modify campaign banner and heading settings.

Vendor
wpswings
Product
Points and Rewards for WooCommerce
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-11
Original CVE updated
2026-07-13
Advisory published
2026-07-11
Advisory updated
2026-07-13

Who should care

Administrators of WordPress sites using the Points and Rewards for WooCommerce plugin, especially those with subscriber-level access or above, should be aware of this vulnerability and take immediate action to protect their sites.

Technical summary

The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to improper verification of user authorization. This allows authenticated attackers with subscriber-level access and above to perform various malicious actions, including converting and draining reward points, exfiltrating user emails and point balances, overwriting Klaviyo API keys, and modifying site settings.

Defensive priority

High

Recommended defensive actions

  • Update the Points and Rewards for WooCommerce plugin to a version that fixes the authorization bypass vulnerability.
  • Restrict access to sensitive plugin settings and features.
  • Monitor site activity for suspicious behavior related to reward points and Klaviyo integration.
  • Consider implementing additional security measures, such as two-factor authentication and regular security audits.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-11T04:17:02.733Z and has not been modified since then. The NVD entry is currently in the 'Received' status. Evidence is limited to CVE and NVD details. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10628 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10628

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10628 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10628

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/admin/class-points-rewards-for-woocommerce-admin.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/admin/class-points-rewards-for-woocommerce-admin.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/admin/class-points-rewards-for-woocommerce-admin.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/public/class-points-rewards-for-woocommerce-public.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.10.0/public/class-points-rewards-for-woocommerce-public.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.9.7/admin/class-points-rewards-for-woocommerce-admin.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/points-and-rewards-for-woocommerce/tags/2.9.7/admin/class-points-rewards-for-woocommerce-admin.php

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.