The Points and Rewards for WooCommerce plugin never properly verified user authorization for several AJAX endpoints. As a result, authenticated users with subscriber-level access or higher can trigger actions that drain any user’s reward points into a wallet, exfiltrate all users’ email addresses and point balances, overwrite the site’s Klaviyo public API key, block or unblock any user from the points system, and modify campaign banner and heading settings. This classic authorization bypass (CWE‑862) permits privilege escalation, data exposure, and revenue manipulation.

WordPress sites that have installed the wpswings Points and Rewards for WooCommerce plugin in versions 2.9.x through 2.10.0 are vulnerable. All installations running these affected releases are at risk of the flaw.

The vulnerability carries a CVSS score of 4.3, indicating moderate severity, and an EPSS score of <1%, indicating a low likelihood of exploitation at the time of this assessment; it is not listed in CISA’s KEV catalog. Exploitation requires a subscriber or higher role, but because the wps_wpr_generate_custom_wallet action is registered on the wp_ajax_nopriv hook and the nonce is injected into every public page, even unauthenticated visitors can obtain a valid nonce and invoke that specific action. The attack vector is remote and mediated through the site’s AJAX interface.