CVE-2026-15001: bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or nonce checks, and the bloyalcustomerautologin function unconditionally trusting the Customer.ExternalId value returned by whichever API URL is stored in the plugin's options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's bLoyal Loyalty Engine API URL (bloyalcustomloyaltyengineapiurl) and the isbloyalcustomapiurl flag via the unprotected AJAX actions, then trigger the unauthenticated /cart REST route to cause bloyalcustomerautologin to fetch customer data from an attacker-controlled endpoint and call wpsetauthcookie() with an attacker-supplied Customer.ExternalId, thereby authenticating as any WordPress user including the site Administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: bLoyal: Loyalty & Promotions by bLoyalto a version that resolves this vulnerability.Fixed in 3.1.611.78 - Configuration
Modify the plugin so the AJAX actions `save_bloyal_configuration_data` and `save_bloyal_accesskeyverification_data` are registered with appropriate capability checks and nonce verification (to prevent Subscriber+ users from overwriting options like `bloyal_custom_loyaltyengine_api_url` and `is_bloyal_custom_api_url`).
WordPress plugin: bLoyal: Loyalty & Promotions by bLoyal AJAX action capability/nonce checks for `save_bloyal_configuration_data` and `save_bloyal_accesskeyverification_data` = capability and nonce checks must be added (no unprotected registration) - Configuration
Update `bloyal_customer_auto_login` to not unconditionally trust the `Customer.ExternalId` returned by the API URL stored in plugin options; validate the external ID (and the source/response) before using it to call `wp_set_auth_cookie()`.
WordPress plugin: bLoyal: Loyalty & Promotions by bLoyal `bloyal_customer_auto_login` trust of `Customer.ExternalId` from API response = must be validated against expected/authorized customer data before calling `wp_set_auth_cookie()` - Compensating control
As a mitigation while fixing, prevent authenticated attackers from reaching the vulnerable behavior: restrict access to the plugin’s WordPress REST endpoint `/cart` (and ensure it cannot be triggered to invoke `bloyal_customer_auto_login` in an unauthenticated context).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15001?
CVE-2026-15001 has a severity rating of high at 8.8.
How can I mitigate CVE-2026-15001?
To mitigate CVE-2026-15001, you should update the bLoyal: Loyalty & Promotions plugin to version 3.1.611.79 or later.
What causes CVE-2026-15001?
CVE-2026-15001 is caused by unprotected AJAX actions that allow for unauthorized privilege escalation in the bLoyal plugin.
Who is affected by CVE-2026-15001?
All users of the bLoyal: Loyalty & Promotions plugin for WordPress prior to version 3.1.611.79 are affected by CVE-2026-15001.
When was CVE-2026-15001 published?
CVE-2026-15001 was published on August 15, 2026.