What the vulnerability does
01Description
The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values.
Explanation of Vulnerability in Simple Terms
02Summary
MyRewards versions 5.6.1 and earlier lack proper authorization checks, allowing authenticated users to modify data they should not have access to. An attacker with a low-privilege account can change records belonging to other users or the system without additional interaction. The vulnerability does not expose sensitive information or disrupt service availability, but enables unauthorized data tampering.
What an attacker can do
03Attacker Capabilities
Modify or tamper with data belonging to other users or the system without authorization.
Potential impact on your site
04Site Impact
Users' reward data and account information can be altered by other authenticated users, compromising data integrity.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege account on the site; no user interaction required.
Key dates
06Disclosure timeline
February 4, 2026
CVE published
April 8, 2026
Record updated
