{
 "id": "WPSEC-2026-1186",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1186/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1186/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1186/index.md",
 "title": "RewardsWP <= 1.6.0 - Missing Authorization to Unauthenticated Settings Overwrite via Setup Completion Handler",
 "description": "The RewardsWP plugin for WordPress is vulnerable to unauthorized modification of data via the setup completion handler in all versions up to, and including, 1.6.0. This is due to a missing capability check on the maybe_migrate_setup_data() function, which is hooked to admin_init and only checks the 'setup' and 'page' query parameters. This makes it possible for unauthenticated attackers to send a request to admin-ajax.php or admin-post.php that re-runs the setup migration. The migration fetches the stored setup wizard results again, merges them over the plugin's current settings (undoing changes made after setup), adds the wizard's deferred actions and activates the wizard's license key. This works while the setup referrer secret is still stored, and older versions never delete it.",
 "plugin": {
  "slug": "rewardswp",
  "name": "RewardsWP",
  "full_name": "RewardsWP – Loyalty Points & Referral Program for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/rewardswp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/rewardswp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/rewardswp"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.6.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.6.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.6.1",
 "remediation": "Update to 1.6.1 or later.",
 "fix_released": "2026-10-16T11:18:48+00:00",
 "published": "2026-10-17T11:42:15+00:00",
 "updated": "2026-10-17T08:19:52.084437+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1186/",
  "https://plugins.svn.wordpress.org/rewardswp/tags/1.6.1/",
  "https://wordpress.org/plugins/rewardswp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/rewardswp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-17"
 }
}