CVE-2026-11782: CWE-284 Improper Access Control in Points and Rewards for WooCommerce
Points and Rewards for WooCommerce plugin versions before 2.10.1 lack proper authorization checks on wallet and points update actions accessible to unauthenticated users. This flaw allows attackers to arbitrarily modify or corrupt the wallet balance and loyalty points of any user without authentication. Modification of wallet balance requires the companion Wallet System for WooCommerce Points and Rewards plugin to be active.
AI Analysis
Technical Summary
CVE-2026-11782 is an improper access control vulnerability (CWE-284) in the Points and Rewards for WooCommerce WordPress plugin prior to version 2.10.1. The plugin does not verify that the requester owns the account being modified and allows unauthenticated users to update wallet and points balances arbitrarily. Exploitation can lead to unauthorized modification or corruption of user wallet balances and loyalty points, including driving balances negative. Modification of wallet balances specifically requires the companion Wallet System plugin to be active.
Potential Impact
An unauthenticated attacker can arbitrarily modify the loyalty points and wallet balances of any user, potentially corrupting these values or driving them negative. This impacts the integrity of user accounts and the rewards system but does not directly affect confidentiality or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin's update actions and monitor for unauthorized changes. Consider disabling the Points and Rewards plugin or the companion Wallet System plugin if not essential.
CVE-2026-11782: CWE-284 Improper Access Control in Points and Rewards for WooCommerce
Description
Points and Rewards for WooCommerce plugin versions before 2.10.1 lack proper authorization checks on wallet and points update actions accessible to unauthenticated users. This flaw allows attackers to arbitrarily modify or corrupt the wallet balance and loyalty points of any user without authentication. Modification of wallet balance requires the companion Wallet System for WooCommerce Points and Rewards plugin to be active.
CVSS v3.1
Score 5.9medium
Affected software
Points and Rewards for WooCommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-11782 is an improper access control vulnerability (CWE-284) in the Points and Rewards for WooCommerce WordPress plugin prior to version 2.10.1. The plugin does not verify that the requester owns the account being modified and allows unauthenticated users to update wallet and points balances arbitrarily. Exploitation can lead to unauthorized modification or corruption of user wallet balances and loyalty points, including driving balances negative. Modification of wallet balances specifically requires the companion Wallet System plugin to be active.
Potential Impact
An unauthenticated attacker can arbitrarily modify the loyalty points and wallet balances of any user, potentially corrupting these values or driving them negative. This impacts the integrity of user accounts and the rewards system but does not directly affect confidentiality or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin's update actions and monitor for unauthorized changes. Consider disabling the Points and Rewards plugin or the companion Wallet System plugin if not essential.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-09T12:33:00.570Z
- State
- PUBLISHED
Threat ID: 6a6aee069c2644c7f8a7eed5
Added to database: 07/30/2026, 06:24:06 UTC
Last enriched: 08/06/2026, 17:39:59 UTC
Last updated: 09/14/2026, 22:01:31 UTC
Views: 47
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.