Improper Input Validation in Points and Rewards for WooCommerce by WordPress
CVE-2026-93510
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 23 September 2026
Badges
What is CVE-2026-93510?
The Points and Rewards for WooCommerce plugin for WordPress prior to version 2.10.4 contains a significant vulnerability that allows authenticated users, including those with Subscriber privileges or higher, to manipulate reward claims. It lacks necessary validation mechanisms to ensure that reward amounts are legitimate or to restrict access to its Win Wheel claim handler. As a result, malicious users can assign themselves arbitrary and potentially unlimited loyalty points. Additionally, if paired with the associated wallet feature, this exploitation could enable users to inflate their wallet balances, posing a risk to the integrity of loyalty programs.
Affected Version(s)
Points and Rewards for WooCommerce 0 < 2.10.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.