CVE-2026-15001 describes a privilege escalation vulnerability in the bLoyal: Loyalty & Promotions by bLoyal WordPress plugin affecting all versions up to 3.1.611.78. The vulnerability is due to the AJAX actions 'save_bloyal_configuration_data' and 'save_bloyal_accesskeyverification_data' lacking capability and nonce verification, enabling authenticated attackers with minimal privileges to overwrite the plugin's API URL settings. Subsequently, the 'bloyal_customer_auto_login' function trusts the 'Customer.ExternalId' from the attacker-controlled API endpoint and calls 'wp_set_auth_cookie()' with this value, effectively allowing attackers to authenticate as any WordPress user, including administrators. This results in a critical privilege escalation vector within the plugin.

An attacker with Subscriber-level access or higher can exploit this vulnerability to escalate privileges to administrator by manipulating plugin settings and triggering an unauthenticated REST route that logs them in as any user. This compromises the confidentiality, integrity, and availability of the WordPress site, allowing full administrative control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's AJAX endpoints and consider disabling or removing the plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.