Description

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-23T06:17:06.057Z",
  "pubdate": "2026-09-23T06:17:06.057Z",
  "executiveSummary": "The Points and Rewards for WooCommerce WordPress plugin (versions prior to 2.10.4) contains a critical authorization and input validation vulnerability within its Win Wheel claim handler.\nThis flaw allows authenticated users, regardless of their role (Subscriber and above), to manipulate loyalty point balances and linked wallet funds.\nThe vulnerability stems from the plugin's failure to validate the requested reward amount or enforce strict server-side permission checks on the request handler.\nBy crafting specific requests, an attacker can bypass intended reward mechanics to credit an arbitrary, unlimited amount of points to their user account.\nThe risk is significantly elevated when the companion wallet plugin is active, as the vulnerability extends to the manipulation of financial wallet balances, potentially leading to unauthorized store credits and monetary loss.\nExploitation requires only an active, authenticated account on the target WordPress site, making this a high-impact security risk for e-commerce environments using this plugin.",
  "technicalDetails": "The vulnerability resides within the plugin's Win Wheel claim handler functionality, which serves as an endpoint for users to finalize and receive rewards based on wheel spin interactions.\nThe root cause is a dual failure in the server-side processing logic: insufficient input validation regarding the requested reward amount and improper access control enforcement on the callback function responsible for updating user records.\nIn the affected versions, the claim handler does not verify whether the client-supplied 'reward amount' matches the legitimate reward configured by the site administrator. Furthermore, the handler fails to validate the user's eligibility or authorization level before modifying the database.\nAn authenticated user, starting at the 'Subscriber' privilege level, can observe the request structure during a standard interaction with the Win Wheel feature. By intercepting and modifying the outgoing request parameters, the user can inject an arbitrary value into the 'reward amount' field.\nBecause the server-side code trusts this user-supplied input without secondary verification against the intended spin outcome, the function executes an unauthorized database update. The system processes the request as if it were a legitimate win, subsequently incrementing the user's loyalty point total by the malicious value.\nIf the 'Points and Rewards for WooCommerce' wallet companion plugin is active, the vulnerability impact expands. The same insecure handler architecture allows the injection to propagate to the wallet balance database, effectively granting the attacker unauthorized financial credit within the WooCommerce ecosystem.\nThe attack flow follows a predictable pattern: 1) The attacker authenticates as a standard user. 2) The attacker triggers the Win Wheel functionality. 3) The attacker captures the HTTP POST request intended for the reward claim handler. 4) The attacker replaces the expected valid reward integer with an arbitrary, high-value integer. 5) The server-side logic blindly processes the input, performing an UPDATE operation on the user_points and/or wallet_balance database tables. 6) The account balance is updated to the malicious value, bypassing all intended reward restrictions and system safeguards."
}