Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-23
Points and Rewards for WooCommerce - Security Vulnerability (CVE-2026-93510)
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.
PLUGIN
Points and Rewards for WooCommerce
CVE-2026-93510
Risk Score
Threat Entry
Updated 2026-07-30
Points and Rewards for WooCommerce - Security Vulnerability (CVE-2026-11782)
The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated attackers to arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce Points and Rewards for WooCommerce WordPress plugin before 2.10.1 to be active.
PLUGIN
Points and Rewards for WooCommerce
CVE-2026-11782
Risk Score
Threat Entry
Updated 2026-07-15
Points And Rewards For Woocommerce - Broken Access Control (CVE-2026-10628)
The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to convert and drain any user's reward points into wallet balance, exfiltrate all users' emails and point balances to an attacker-controlled Klaviyo account, overwrite the site's Klaviyo public API key, block or unblock arbitrary users from the points…
PLUGIN
Points And Rewards For Woocommerce
CVE-2026-10628
Risk Score
Threat Entry
Updated 2026-06-17
Points And Rewards For Woocommerce - Broken Access Control (CVE-2026-24581)
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce points-and-rewards-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Points and Rewards for WooCommerce: from n/a through
PLUGIN
Points And Rewards For Woocommerce
CVE-2026-24581
Risk Score
Threat Entry
Updated 2026-06-17
Points And Rewards For Woocommerce - Broken Access Control (CVE-2023-27608)
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0.
PLUGIN
Points And Rewards For Woocommerce
CVE-2023-27608
Risk Score