CVE-2026-10628 is an authorization bypass vulnerability in the Points and Rewards for WooCommerce WordPress plugin affecting all versions up to 2.10.0. The plugin fails to properly verify user authorization for sensitive actions, allowing authenticated users with subscriber-level privileges or higher to manipulate reward points of any user, exfiltrate sensitive user data to an attacker-controlled Klaviyo account, overwrite the Klaviyo public API key, and modify user and campaign settings. The nonce used for request authentication is injected into every public-facing page, and a specific AJAX handler is registered for unauthenticated users, enabling even unauthenticated visitors to obtain a valid nonce and exploit the wps_wpr_generate_custom_wallet action. No official patch or remediation level has been indicated in the vendor or CVE data.

The vulnerability allows attackers with minimal privileges (subscriber-level) to perform unauthorized actions that impact integrity and confidentiality. Attackers can drain reward points from any user, exfiltrate user emails and point balances, overwrite critical API keys, and manipulate user access and campaign settings. This compromises user data confidentiality and the integrity of the points and rewards system. The exposure of the nonce on public pages and the unauthenticated AJAX handler increases the attack surface, potentially allowing unauthenticated exploitation of at least one action.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities if possible and monitor for suspicious activity related to points and rewards manipulation. Avoid exposing sensitive nonces on public pages and review AJAX handlers that allow unauthenticated access. Follow vendor updates closely for an official fix or temporary mitigation.