CVE-2026-15001 is a privilege escalation vulnerability in the bLoyal: Loyalty & Promotions by bLoyal WordPress plugin affecting all versions up to and including 3.1.611.78. The flaw arises because the AJAX actions 'save_bloyal_configuration_data' and 'save_bloyal_accesskeyverification_data' lack capability and nonce checks, allowing authenticated users with minimal privileges to overwrite the plugin's API URL and a related flag. Subsequently, the unauthenticated '/cart' REST route invokes 'bloyal_customer_auto_login', which trusts the 'Customer.ExternalId' value from the attacker-controlled API URL and calls 'wp_set_auth_cookie()' with it. This results in authentication as any WordPress user, including administrators, effectively bypassing privilege restrictions.

An attacker with Subscriber-level access or higher can escalate privileges to administrator by manipulating plugin configuration and triggering an unauthenticated REST endpoint. This leads to full site compromise, including complete control over the WordPress installation, data, and administrative functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.