Threats Tagged 'cve-2026-10628'

Points and Rewards for WooCommerce plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 2.10.0. This flaw allows authenticated users with subscriber-level access or higher to perform unauthorized actions such as converting and draining other users' reward points, exfiltrating user emails and point balances, overwriting the site's Klaviyo public API key, blocking or unblocking users from the points system, and modifying campaign settings. Additionally, a nonce used for authentication is exposed on public pages, enabling unauthenticated visitors to exploit a specific action handler. The vulnerability has a medium severity rating with a CVSS score of 4.3. No official patch or remediation guidance is currently available.