CVE-2026-11782 is an improper access control vulnerability (CWE-284) in the Points and Rewards for WooCommerce WordPress plugin prior to version 2.10.1. The plugin does not verify that the requester is authorized or owns the account when performing wallet and points update actions. This flaw enables unauthenticated attackers to arbitrarily modify or corrupt stored wallet balances and loyalty points of any user. Modification of wallet balances requires the companion Wallet System for WooCommerce Points and Rewards plugin to be active. No CVSS score or vendor advisory with patch information is currently available.

Unauthenticated attackers can arbitrarily alter the wallet balances and loyalty points of any user, potentially causing financial discrepancies or denial of rewards. This could lead to fraudulent point accumulation or depletion, undermining trust and integrity of the rewards system. The impact is limited to installations using the affected plugin versions and, for wallet balance changes, also requires the companion Wallet System plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin functionality and monitor for suspicious activity. Avoid using affected versions in production environments where possible.