The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to privilege escalation for authenticated users with Subscriber level access and above. The vulnerability is caused by the AJAX actions `save_bloyal_configuration_data` and `save_bloyal_accesskeyverification_data` being registered without sufficient capability or nonce checks. An attacker can overwrite the plugin’s Loyalty Engine API URL and the custom API flag, allowing later triggering of an unauthenticated `/cart` REST route that calls the `bloyal_customer_auto_login` function. The function trusts the `Customer.ExternalId` returned by the configured endpoint and calls `wp_set_auth_cookie()` with that value, effectively authenticating the attacker as any WordPress user, including the Administrator. This is a classic privilege escalation flaw (CWE‑269).

Affected systems are installations of the bLoyal: Loyalty & Promotions by bLoyal WordPress plugin from the vendor connectordev. All versions up to and including 3.1.611.78 are impacted. Site administrators running WordPress with this plugin should verify their installed version and apply remediation.

The CVSS score is 8.8, indicating high severity. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and the EPSS score is unavailable, but the nature of the flaw—unauthenticated REST route combined with unprotected AJAX endpoints—suggests that an attacker with moderate access could achieve full site compromise. The attack requires an authenticated user to use the unprotected AJAX actions, then an unauthenticated request to the `/cart` endpoint to trigger auto‑login. Because the vulnerability relies on configuration changes that can be performed by users with a Subscriber role, the risk surface is broad on multi‑user installations.