CVE-2026-10628: WooCommerce Points Plugin Auth Bypass Flaw

CVE-2026-10628 Overview

CVE-2026-10628 is an authorization bypass vulnerability [CWE-862] in the Points and Rewards for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 2.10.0. The plugin fails to verify that a user is authorized to perform sensitive actions exposed through its AJAX handlers.

Authenticated attackers with subscriber-level access can convert and drain any user's reward points into wallet balance, exfiltrate user emails and point balances to an attacker-controlled Klaviyo account, overwrite the site's Klaviyo public API key, block or unblock users, and modify campaign banner settings. The wps_wpr_generate_custom_wallet handler is also registered on the wp_ajax_nopriv_ hook, allowing unauthenticated exploitation of that specific action.

Critical Impact
Low-privilege or unauthenticated attackers can drain user reward points, exfiltrate customer data to attacker-controlled Klaviyo accounts, and manipulate site loyalty settings.

Affected Products

Points and Rewards for WooCommerce plugin for WordPress — all versions up to and including 2.10.0
Version 2.9.7 confirmed vulnerable via referenced source code
WordPress sites using WooCommerce with this plugin installed

Discovery Timeline

2026-07-11 - CVE-2026-10628 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-10628

Vulnerability Analysis

The vulnerability stems from missing capability checks in multiple AJAX handlers exposed by the Points and Rewards for WooCommerce plugin. The plugin relies solely on a WordPress nonce named wps-wpr-verify-nonce to authenticate privileged actions. Nonces in WordPress prevent cross-site request forgery but do not enforce authorization.

The plugin injects this nonce into every public-facing page via wp_localize_script(). Any authenticated user, including a subscriber, can extract the nonce and submit it with AJAX requests targeting administrative functionality. Because the handlers never call current_user_can() or verify the requesting user's identity against the target user, attackers can operate on arbitrary user accounts.

The impacted actions include converting points to wallet balance, syncing user data to a Klaviyo integration, overwriting the stored Klaviyo API key, blocking or unblocking users from the points system, and updating campaign banner and heading settings.

Root Cause

The root cause is broken access control (Missing Authorization, [CWE-862]). The plugin conflates nonce verification with authorization. A valid nonce proves request origin but not that the requester holds the required capability or owns the targeted resource. Sensitive handlers omit both capability checks and user-ownership validation.

Attack Vector

An attacker registers or uses any subscriber-level account on the target WordPress site. They load any public page to harvest the wps-wpr-verify-nonce value injected via wp_localize_script(). They then issue crafted admin-ajax.php POST requests specifying arbitrary target user IDs.

For the wps_wpr_generate_custom_wallet action, the handler is registered on the wp_ajax_nopriv_ hook, so unauthenticated visitors can also obtain the nonce and invoke this specific action without any account.

The vulnerable handlers are referenced in the plugin source at admin/class-points-rewards-for-woocommerce-admin.php lines 1814, 2568, and 2657, and public/class-points-rewards-for-woocommerce-public.php lines 191 and 3493.

Detection Methods for CVE-2026-10628

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php from low-privilege or unauthenticated sessions referencing actions such as wps_wpr_generate_custom_wallet, wps_wpr_klaviyo_sync, or wallet conversion handlers.
Unexpected changes to the site's Klaviyo public API key in plugin settings.
Sudden drops in user reward point balances paired with corresponding wallet balance increases on unrelated accounts.
Users appearing in the plugin's block list without administrator action.

Detection Strategies

Review web server access logs for high-volume AJAX requests targeting wps_wpr_* action names from a single session or IP address.
Audit WordPress user meta and plugin options for unexpected modifications to point balances, wallet balances, and blocked-user lists.
Compare current plugin settings against a known-good baseline, focusing on Klaviyo integration keys and campaign banner content.

Monitoring Recommendations

Enable WordPress activity logging plugins to capture AJAX action names and originating user IDs.
Alert on outbound HTTPS connections from the web server to klaviyo.com endpoints that do not match approved integration configurations.
Monitor plugin option tables for writes to Klaviyo API key entries outside of administrator sessions.

How to Mitigate CVE-2026-10628

Immediate Actions Required

Update Points and Rewards for WooCommerce to a version later than 2.10.0 once the vendor publishes a patched release.
Rotate the Klaviyo public API key and review the connected Klaviyo account for unauthorized profile ingestion.
Audit user point balances, wallet balances, and blocked-user lists for unauthorized modifications and reconcile against transaction history.
Restrict new subscriber registrations temporarily if the site does not require open registration.

Patch Information

The issue is tracked in the plugin's WordPress.org repository. Refer to the WordPress Changeset Details and the Wordfence Vulnerability Report for the fixed version and remediation details.

Workarounds

Deactivate the Points and Rewards for WooCommerce plugin until a fixed version is installed.
Deploy a web application firewall rule that blocks POST requests to admin-ajax.php with action parameters matching wps_wpr_* from non-administrator sessions.
Disable open user registration to eliminate the subscriber-level attack path for authenticated actions.

bash

# Example WAF rule (ModSecurity) to block unauthenticated wps_wpr_generate_custom_wallet abuse
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1026628,\
    msg:'Block Points and Rewards for WooCommerce vulnerable AJAX action'"
    SecRule ARGS:action "@rx ^wps_wpr_(generate_custom_wallet|klaviyo|block_user|unblock_user|update_banner)"