# RewardsWP <= 1.6.0 - Missing Authorization to Unauthenticated Settings Overwrite via Setup Completion Handler

- **ID:** WPSEC-2026-1186
- **Plugin:** RewardsWP – Loyalty Points & Referral Program for WooCommerce (`rewardswp`), https://wordpress.org/plugins/rewardswp/
- **Affected versions:** all versions before 1.6.1
- **Fixed in:** 1.6.1 (Update to 1.6.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/rewardswp
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1186/

## Description

The RewardsWP plugin for WordPress is vulnerable to unauthorized modification of data via the setup completion handler in all versions up to, and including, 1.6.0. This is due to a missing capability check on the maybe_migrate_setup_data() function, which is hooked to admin_init and only checks the 'setup' and 'page' query parameters. This makes it possible for unauthenticated attackers to send a request to admin-ajax.php or admin-post.php that re-runs the setup migration. The migration fetches the stored setup wizard results again, merges them over the plugin's current settings (undoing changes made after setup), adds the wizard's deferred actions and activates the wizard's license key. This works while the setup referrer secret is still stored, and older versions never delete it.

## References

- https://wpsec.com/vuln/WPSEC-2026-1186/
- https://plugins.svn.wordpress.org/rewardswp/tags/1.6.1/
- https://wordpress.org/plugins/rewardswp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1186/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.