Description

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions `save_bloyal_configuration_data` and `save_bloyal_accesskeyverification_data` being registered without any capability or nonce checks, and the `bloyal_customer_auto_login` function unconditionally trusting the `Customer.ExternalId` value returned by whichever API URL is stored in the plugin's options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's bLoyal Loyalty Engine API URL (`bloyal_custom_loyaltyengine_api_url`) and the `is_bloyal_custom_api_url` flag via the unprotected AJAX actions, then trigger the unauthenticated `/cart` REST route to cause `bloyal_customer_auto_login` to fetch customer data from an attacker-controlled endpoint and call `wp_set_auth_cookie()` with an attacker-supplied `Customer.ExternalId`, thereby authenticating as any WordPress user including the site Administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T03:16:47.393Z",
  "pubdate": "2026-08-15T03:16:47.393Z",
  "executiveSummary": "The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress in all versions up to, and including, 3.1.611.78 suffers from a critical Privilege Escalation vulnerability.\nThe flaw allows authenticated attackers with Subscriber-level access and above to arbitrarily authenticate as any WordPress user, including site Administrators, leading to full site compromise.\nThe vulnerability stems from improper access control in AJAX actions and insecure deserialization or handling of external API responses during auto-login routines.\nExploitation requires authenticated access at the Subscriber level to modify plugin configuration parameters, followed by triggering unauthenticated REST route requests.\nThe risk implications are severe, as low-privileged users can instantly escalate their privileges to administrative control over the vulnerable WordPress instance.",
  "technicalDetails": "The root cause of the vulnerability lies in the AJAX actions save_bloyal_configuration_data and save_bloyal_accesskeyverification_data, which are registered without implementing any capability checks or nonce validations.\nAdditionally, the bloyal_customer_auto_login function unconditionally trusts the Customer.ExternalId value returned by the API URL stored in the plugin's configuration options.\nThe affected components include the unprotected AJAX endpoints, the configuration settings bloyal_custom_loyaltyengine_api_url and is_bloyal_custom_api_url, the bloyal_customer_auto_login function, and the unauthenticated /cart REST route.\nAll versions of the bLoyal: Loyalty & Promotions by bLoyal plugin up to, and including, 3.1.611.78 are affected.\nThe attack flow proceeds as follows: First, an authenticated attacker with Subscriber-level access leverages the unprotected AJAX actions save_bloyal_configuration_data and save_bloyal_accesskeyverification_data to overwrite the plugin's bLoyal Loyalty Engine API URL (bloyal_custom_loyaltyengine_api_url) and enable the is_bloyal_custom_api_url flag, pointing them to an attacker-controlled endpoint.\nSecond, the attacker triggers the unauthenticated /cart REST route.\nThird, this action invokes the bloyal_customer_auto_login function, which fetches customer data from the attacker-controlled endpoint.\nFinally, the function calls wp_set_auth_cookie() utilizing the attacker-supplied Customer.ExternalId, successfully authenticating the session as any targeted WordPress user, including the site Administrator.\nThe post-exploitation impact grants the attacker complete administrative control over the underlying WordPress site, allowing arbitrary code execution, data theft, or complete system takeover."
}