CVE-2025-15260: MyRewards WordPress Auth Bypass Flaw

CVE-2025-15260 Overview

The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress contains a missing authorization vulnerability affecting all versions up to and including 5.6.0. This vulnerability exists due to the plugin not properly verifying that a user is authorized to perform specific actions within the ajax function. Authenticated attackers with subscriber-level access or above can exploit this flaw to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values.

Critical Impact

Authenticated attackers with minimal privileges (subscriber level) can manipulate loyalty program rules and point multipliers, potentially leading to financial losses and abuse of reward systems.

Affected Products

• MyRewards – Loyalty Points and Rewards for WooCommerce plugin versions up to and including 5.6.0
• WordPress sites using the vulnerable plugin versions
• WooCommerce stores with loyalty point systems enabled

Discovery Timeline

• 2026-02-04 - CVE CVE-2025-15260 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-15260

Vulnerability Analysis

This vulnerability falls under CWE-862 (Missing Authorization), a critical access control weakness where the application fails to perform authorization checks before allowing users to execute privileged actions. The vulnerable code path exists within the ajax function of the plugin's editlistcontroler.php file, which handles administrative operations for loyalty program management.

The flaw enables low-privileged authenticated users (subscribers) to bypass intended access restrictions and directly interact with the loyalty program's backend functionality. This is particularly dangerous in e-commerce environments where loyalty points often have direct monetary value or can be exchanged for discounts and products.

Root Cause

The root cause is inadequate authorization verification in the plugin's AJAX handler. The ajax function in editlistcontroler.php does not properly validate whether the requesting user has sufficient privileges to perform administrative actions on loyalty earning rules. The plugin appears to check for authentication (whether a user is logged in) but fails to verify the user's role or capabilities before processing requests that should be restricted to administrators or shop managers.

Attack Vector

An attacker needs only a valid WordPress subscriber account to exploit this vulnerability. The attack is conducted over the network by sending crafted AJAX requests directly to the vulnerable endpoint. Since no user interaction is required beyond initial authentication, the attack can be automated to systematically manipulate loyalty program configurations.

The attacker could:

1. Create new earning rules that grant excessive points for minimal actions
2. Modify existing point multipliers to inflate point values
3. Delete legitimate earning rules to disrupt the loyalty program
4. Manipulate conditions and thresholds to benefit specific accounts

The vulnerability allows direct manipulation of loyalty program earning rules through unauthorized AJAX requests. The vulnerable code path in editlistcontroler.php at line 76 processes modification requests without validating user capabilities. An attacker with subscriber privileges can craft requests to the AJAX handler to add, modify, or delete earning rules and point multipliers. For detailed technical analysis, see the WordPress Code Review.

Detection Methods for CVE-2025-15260

Indicators of Compromise

• Unexpected modifications to loyalty program earning rules in WooCommerce settings
• Unusual point multiplier values or newly created earning rules not authorized by administrators
• AJAX requests to the plugin's editlistcontroler.php endpoint from low-privileged user sessions
• Audit log entries showing loyalty program changes made by subscriber-level accounts

Detection Strategies

• Monitor WordPress AJAX requests for actions targeting the MyRewards plugin from non-administrative users
• Implement logging for all changes to loyalty program configurations and review for unauthorized modifications
• Review user activity logs for subscribers or customers making administrative-level API calls
• Set up alerts for bulk point balance changes or unusual reward redemption patterns

Monitoring Recommendations

• Enable comprehensive audit logging for WooCommerce and loyalty plugin activities
• Configure web application firewall (WAF) rules to monitor AJAX traffic patterns to plugin endpoints
• Regularly audit loyalty program configurations for unauthorized changes
• Implement real-time alerts for privilege escalation attempts or authorization bypass patterns

How to Mitigate CVE-2025-15260

Immediate Actions Required

• Update the MyRewards – Loyalty Points and Rewards for WooCommerce plugin to a version newer than 5.6.0 when available
• Audit current loyalty program earning rules and point multipliers for unauthorized modifications
• Review subscriber and customer accounts for suspicious activity related to loyalty points
• Consider temporarily disabling the plugin until a patched version is available if the risk is unacceptable

Patch Information

Organizations should monitor the official WordPress plugin repository and the Wordfence Vulnerability Report for patch availability. Until an official fix is released, implementing the workarounds below is strongly recommended.

Workarounds

• Implement additional access control at the web server level to restrict AJAX endpoints to administrative IP addresses
• Use a WordPress security plugin to add capability checks for AJAX requests to the vulnerable endpoint
• Temporarily restrict the subscriber role's AJAX capabilities using a custom plugin or security configuration
• Monitor and log all AJAX requests to the affected plugin endpoint for forensic analysis

# Configuration example for Apache to restrict access to the vulnerable endpoint
# Add to .htaccess in the WordPress root directory
<Files "admin-ajax.php">
    <If "%{QUERY_STRING} =~ /woorewards|editlistcontroler/">
        Require ip 192.168.1.0/24
    </If>
</Files>