RewardsWP <= 1.6.0 - Missing Authorization to Unauthenticated Settings Overwrite via Setup Completion Handler
- ID
- WPSEC-2026-1186
- Plugin
- RewardsWP – Loyalty Points & Referral Program for WooCommerce (rewardswp)
- Affected
- all versions before 1.6.1
- Remediation
- Update to 1.6.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-17
- Attack surface
- RewardsWP on WPSec AttackSurface
- Fix released
- Published
Description
The RewardsWP plugin for WordPress is vulnerable to unauthorized modification of data via the setup completion handler in all versions up to, and including, 1.6.0. This is due to a missing capability check on the maybe_migrate_setup_data() function, which is hooked to admin_init and only checks the 'setup' and 'page' query parameters. This makes it possible for unauthenticated attackers to send a request to admin-ajax.php or admin-post.php that re-runs the setup migration. The migration fetches the stored setup wizard results again, merges them over the plugin's current settings (undoing changes made after setup), adds the wizard's deferred actions and activates the wizard's license key. This works while the setup referrer secret is still stored, and older versions never delete it.
References
- https://wpsec.com/vuln/WPSEC-2026-1186/
- https://plugins.svn.wordpress.org/rewardswp/tags/1.6.1/
- https://wordpress.org/plugins/rewardswp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS