CVE-2025-15260

MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification

View on CVE.org

Published Feb 4, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values.

Analysis

Technical impact

The MyRewards plugin for WooCommerce contains a missing authorization flaw in the AJAX handler that allows any authenticated user with Subscriber or higher privileges to modify, add, or delete loyalty program earning rules. Because the plugin fails to verify the user’s rights, attackers can arbitrarily change point multipliers or rule conditions, which could grant them excessive rewards or reduce competitors’ benefits. The vulnerability is a classic Authorization Bypass (CWE‑862) and does not grant arbitrary code execution, but it enables significant financial abuse of the loyalty system.

Affected Systems

Any WordPress site running the MyRewards Loyalty Points and Rewards plugin version 5.6.1 or earlier is vulnerable. The issue affects the plugin provided by lwsdevelopers, and all deployments using that version in a WooCommerce environment.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate risk. The EPSS shows less than 1%, suggesting the likelihood of exploitation in this moment is low, and the vulnerability is not listed in CISA KEV. However, once a site is discovered, attackers could exploit the flaw remotely through standard AJAX calls without additional privileges, so the risk is real for sites with exposed APIs. The attack vector is a crafted AJAX request using a Subscriber account or higher, bypassing the missing authorization check.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

lwsdevelopers

MyRewards

unaffected

Version	Status	Constraints
`0`	affected	≤ 5.6.1

No data.

Vendor	Product	Versions
Lwsdevelopers	Myrewards	—
Woocommerce	Woocommerce	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the MyRewards plugin to a version newer than 5.6.1 that includes the authorization fix.
If an update cannot be applied immediately, restrict Subscriber role from accessing the loyalty rule management UI or through AJAX by removing relevant capabilities or adding role restrictions.
Audit current loyalty rules and enable detailed logging of rule modifications to detect any unauthorized changes.

Generated by OpenCVE AI on April 22, 2026 at 15:33 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.304% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/woorewards/tags/5.6.0/assets/lws-adminpanel/include/internal/editlistcontroler.php#L76
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3458815%40woorewards&new=3458815%40woorewards&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/2591f473-44ff-4319-8b17-b0f793a29d66?source=cve

History

Apr 8, 2026 5:00 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description	The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values.	The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values.
Title	MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification	MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification
References		https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3458815%40woorewards&new=3458815%40woorewards&sfp_email=&sfph_mail=

Feb 4, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Lwsdevelopers Lwsdevelopers myrewards Woocommerce Woocommerce woocommerce Wordpress Wordpress wordpress
Vendors & Products		Lwsdevelopers Lwsdevelopers myrewards Woocommerce Woocommerce woocommerce Wordpress Wordpress wordpress

Feb 4, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 4, 2026 8:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values.
Title		MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/woorewards/tags/5.6.0/assets/lws-adminpanel/include/internal/editlistcontroler.php#L76 https://www.wordfence.com/threat-intel/vulnerabilities/id/2591f473-44ff-4319-8b17-b0f793a29d66?source=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}`