CVE-2026-11782 Overview
CVE-2026-11782 affects the Points and Rewards for WooCommerce WordPress plugin in versions before 2.10.1. The plugin exposes a wallet and points update action to unauthenticated users without authorization checks. It also fails to verify that the requester owns the account being modified. Unauthenticated attackers can arbitrarily modify or corrupt the stored wallet balance and loyalty points of any user, including driving balances negative. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce Points and Rewards for WooCommerce plugin (also before 2.10.1) to be active on the site.
Critical Impact
Unauthenticated attackers can arbitrarily alter, inflate, or corrupt wallet balances and loyalty points for any user account on affected WooCommerce stores.
Affected Products
- Points and Rewards for WooCommerce WordPress plugin versions before 2.10.1
- Wallet System for WooCommerce Points and Rewards for WooCommerce plugin versions before 2.10.1 (required for wallet balance modification)
- WordPress sites running WooCommerce with the affected plugins active
Discovery Timeline
- 2026-07-30 - CVE-2026-11782 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-11782
Vulnerability Analysis
The vulnerability is a broken access control issue in the wallet and points update action exposed by the Points and Rewards for WooCommerce plugin. The affected action handler is registered in a way that makes it reachable by unauthenticated visitors. It performs no capability check and no ownership check against the target user identifier supplied in the request.
An attacker submits a crafted request specifying an arbitrary target user identifier along with a new point balance or wallet delta. The plugin writes the value directly to the user's stored balance without validating the caller. Because the write path accepts arbitrary values, attackers can inflate a balance for later redemption or drive it negative to corrupt user accounts.
Wallet balance manipulation additionally depends on the companion Wallet System for WooCommerce Points and Rewards for WooCommerce plugin being active. Points modification works independently of the wallet plugin.
Root Cause
The root cause is missing authorization on a state-changing action. The handler does not confirm that the requester is authenticated and does not verify that the requester owns the account referenced in the request payload. This is a classic broken access control pattern combined with an insecure direct object reference on the user identifier.
Attack Vector
Exploitation occurs over HTTP against the WordPress site hosting the vulnerable plugin. No authentication, no user interaction, and no prior access are required. An attacker sends a request to the plugin's exposed update endpoint with the target user identifier and desired balance. Technical details of the request format are documented in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-11782
Indicators of Compromise
- Unexpected changes to wp_usermeta entries storing points or wallet balances for user accounts
- Negative wallet or points values for user accounts that should have positive or zero balances
- WooCommerce orders redeeming unusually large point balances or wallet credits shortly after account balance changes
- Access log entries showing unauthenticated POST requests to the plugin's wallet or points update action
Detection Strategies
- Audit database records for the Points and Rewards and Wallet System plugins to identify balance changes without corresponding order, refund, or admin action history
- Correlate WooCommerce order history with balance change events to find redemptions unbacked by legitimate accrual
- Alert on HTTP requests to WordPress AJAX or REST endpoints associated with the plugin from unauthenticated sessions
Monitoring Recommendations
- Enable verbose access logging on /wp-admin/admin-ajax.php and plugin REST routes and review for anomalous unauthenticated traffic
- Monitor for spikes in point or wallet redemption activity across many user accounts within short time windows
- Track WordPress plugin versions across managed sites to confirm both plugins are updated to 2.10.1 or later
How to Mitigate CVE-2026-11782
Immediate Actions Required
- Update the Points and Rewards for WooCommerce plugin to version 2.10.1 or later
- Update the Wallet System for WooCommerce Points and Rewards for WooCommerce plugin to version 2.10.1 or later if installed
- Audit user wallet and point balances for unexpected values, including negative balances, and reconcile against transaction history
- Review recent WooCommerce orders for redemptions that may have used fraudulently modified balances
Patch Information
The vendor addressed the issue in version 2.10.1 of both plugins. Refer to the WPScan Vulnerability Report for advisory details and fixed version confirmation.
Workarounds
- Deactivate the Points and Rewards for WooCommerce plugin and the companion Wallet System plugin until both can be updated to 2.10.1
- Restrict access to the WordPress AJAX and REST endpoints exposed by the plugin using a web application firewall rule blocking unauthenticated requests to the affected action
- Temporarily disable point redemption and wallet withdrawal features at the store level to limit financial impact while patching
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
