This vulnerability is a missing authorization flaw in the WP Swings Points and Rewards for WooCommerce plugin, where improper access control checks enable a user to execute admin‑level functions without proper privileges. As a result, an attacker can manipulate points, rewards, or related settings beyond their allowed scope, potentially leading to financial loss or credential compromise for target accounts. The weakness is categorized as CWE‑862, an improper authorization weakness.

The problem affects the WP Swings Points and Rewards for WooCommerce plugin, in all releases up to and including version 2.9.5. Users running any older or older patch edition of the plugin are potentially exposed.

The CVSS base score of 5.4 indicates moderate severity, and the EPSS probability is less than 1%, suggesting a low but non‑zero likelihood of exploitation. The issue has not been reported in CISA’s KEV catalog. Because the flaw involves incorrect assignment of access rights, an attacker who can exploit any authenticated user session or who can create a new user will be able to bypass restrictions. The attack could be performed remotely via legitimate plugin interfaces, requiring no special network access.