CVE-2026-11782: The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthen
The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated attackers to arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce Points and Rewards for WooCommerce WordPress plugin before 2.10.1 to be active.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-11782
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-117820.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-11782 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Points and Rewards
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-16091: The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPres…nvd · 2026-08-01
- mediumCVE-2026-16090: The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPres…nvd · 2026-08-01
- mediumCVE-2026-15730: The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPres…nvd · 2026-07-28
- highCVE-2026-7534: The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site …nvd · 2026-07-23
- mediumCVE-2026-10628: The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization byp…nvd · 2026-07-11
- mediumCVE-2026-13450: The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPres…nvd · 2026-07-09
More from NVD Recent CVEs
- mediumCVE-2026-18573: A flaw was found in the keycloak-services component of Keycloak, which is used for managing au…2026-08-02
- mediumCVE-2026-18572: Keycloak provides authorization services that allow administrators to restrict access to resou…2026-08-02
- mediumCVE-2026-18571: A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permission…2026-08-02
- mediumCVE-2026-18570: A flaw was found in the full-scope-disabled client-policy executor within the keycloak-service…2026-08-02
- unknownCVE-2026-16540: The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict …2026-08-02