CVE-2026-93510 in Points and Rewards for WooCommerce Plugin
Summary
by MITRE • 09/23/2026
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in the Points and Rewards for WooCommerce WordPress plugin prior to version 2.10.4 represents a critical failure in access control and input validation mechanisms within the application's loyalty program infrastructure. This flaw specifically affects the Win Wheel claim handler, which is designed to process rewards earned by users through interactive game mechanics or promotional activities. The core technical deficiency lies in the server-side logic that processes claims for these rewards. Instead of verifying whether a user has legitimately won a specific prize based on historical data and session state, the application blindly accepts the reward amount submitted by the client side. Furthermore, there is no enforcement of role-based access controls to restrict who can invoke this handler, allowing any authenticated user with a Subscriber account or higher to interact directly with the endpoint responsible for crediting accounts.
From an architectural perspective, this vulnerability stems from a lack of server-side validation and insufficient authorization checks. The application fails to implement proper integrity verification on the claimed reward amount, treating client-supplied data as trustworthy without cross-referencing it against established game rules or user eligibility criteria. This design oversight allows for arbitrary value manipulation, where an attacker can specify any numerical value in their request payload. By exploiting this lack of validation, malicious actors can bypass intended limits and credit their own accounts with unlimited loyalty points. In environments where the companion wallet plugin is also active, this exploitation extends to financial balances, enabling attackers to inflate their digital wallets without performing legitimate transactions or earning rewards through standard platform activities.
The operational impact of this vulnerability is severe, particularly for e-commerce platforms relying on these plugins for customer retention and engagement strategies. The ability to generate unlimited loyalty points can lead to significant financial loss if those points are redeemable for goods, services, or discounts that have real-world monetary value. Attackers can exploit this flaw to purchase high-value items at no cost, effectively draining the merchant's inventory or revenue streams. Additionally, the integrity of the loyalty program is compromised, potentially leading to inflation within the platform's virtual economy and eroding trust among legitimate users who adhere to the rules. The presence of a companion wallet plugin amplifies the risk by converting these manipulated points into spendable currency, thereby increasing the direct financial exposure for the business owner.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as it allows lower-privileged users to perform actions restricted to higher privileges or intended only for specific game outcomes. It also relates closely to CWE-347, Improper Verification of Cryptographic Signature, in the broader context of trusting client-side data without server-side validation, although here the issue is more directly tied to logic flaws rather than cryptographic failures. In terms of offensive security frameworks, this exploit maps to MITRE ATT&CK technique T1098, specifically Account Manipulation or Privilege Escalation via application logic abuse, where an attacker alters their account status or assets through unauthorized means. The exploitation path typically involves intercepting the HTTP request sent by the Win Wheel claim handler and modifying the reward amount parameter before resending it to the server, a process that requires only basic knowledge of web traffic interception tools like Burp Suite.
Mitigation strategies must focus on implementing robust server-side validation and strict access controls. Developers should ensure that all inputs related to rewards are validated against predefined rulesets stored in the database or application logic, rather than trusting values sent from the client. The Win Wheel claim handler must be restricted to authenticated users who have actually participated in the game session associated with the reward, verifying session tokens and historical data before processing any claims. Additionally, implementing rate limiting can help mitigate automated exploitation attempts by detecting unusual patterns of requests originating from a single IP address or user account. Upgrading to version 2.10.4 or later is essential as it addresses these specific logic flaws. Until an upgrade is performed, administrators should consider disabling the Win Wheel feature temporarily and monitoring for suspicious spikes in point redemptions or wallet balance changes that do not correspond with legitimate user activity logs.