The MyRewards plugin for WooCommerce contains a missing authorization flaw in the AJAX handler that allows any authenticated user with Subscriber or higher privileges to modify, add, or delete loyalty program earning rules. Because the plugin fails to verify the user’s rights, attackers can arbitrarily change point multipliers or rule conditions, which could grant them excessive rewards or reduce competitors’ benefits. The vulnerability is a classic Authorization Bypass (CWE‑862) and does not grant arbitrary code execution, but it enables significant financial abuse of the loyalty system.

Any WordPress site running the MyRewards Loyalty Points and Rewards plugin version 5.6.1 or earlier is vulnerable. The issue affects the plugin provided by lwsdevelopers, and all deployments using that version in a WooCommerce environment.

The CVSS score of 6.5 indicates moderate risk. The EPSS shows less than 1%, suggesting the likelihood of exploitation in this moment is low, and the vulnerability is not listed in CISA KEV. However, once a site is discovered, attackers could exploit the flaw remotely through standard AJAX calls without additional privileges, so the risk is real for sites with exposed APIs. The attack vector is a crafted AJAX request using a Subscriber account or higher, bypassing the missing authorization check.