The vulnerability is a missing authorization check in the Long Watch Studio MyRewards plugin that allows an attacker to bypass intended access controls. This flaw can enable unauthorized users to perform privileged actions through the plugin’s interface or web endpoints, effectively escalating privileges within the WordPress site. The weakness falls under the privilege escalation category.

The affected product is the WordPress plugin MyRewards from Long Watch Studio (also known as woorewards), with all releases through version 5.7.3 vulnerable. Any WordPress installation that has this plugin installed and uses one of those versions is at risk, regardless of the WordPress core version.

There is no published CVSS score or EPSS value, and the issue is not listed in CISA’s KEV catalog, so the objective exploit probability is unknown. However, because the flaw is an access control bypass, it can be leveraged by anyone who can access the plugin’s web interface, making the potential impact significant if the site is publicly reachable or if an attacker can obtain basic user credentials. The most likely attack vector is through crafted HTTP requests to the plugin’s administrative endpoints, requiring only web access to the vulnerable WordPress instance.