CVE-2026-93510: Points and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_points
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Points and Rewards for WooCommerce WordPress pluginto a version that resolves this vulnerability.Fixed in 2.10.4
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker does not need administrative or shop-management privileges.
What does an attacker need to do to manipulate points or balances?
They need access to an authenticated account and the ability to invoke the Win Wheel claim handler. The handler does not validate the claimed reward amount or adequately restrict which authenticated users can call it.
Are wallet balances affected in every installation?
No. Loyalty points can be credited arbitrarily, while wallet balance manipulation applies where the companion wallet Points and Rewards for WooCommerce plugin is active.
How can administrators determine whether they may be affected?
Check whether WP Swings Points and Rewards for WooCommerce is installed at a version earlier than 2.10.4. Also review loyalty-point and, where applicable, wallet-balance activity for unusually large or repeated credits associated with Subscriber or other low-privilege accounts.