RewardsWP <= 1.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Guest Order Takeover via Order Linking Verification
- ID
- WPSEC-2026-1187
- Plugin
- RewardsWP – Loyalty Points & Referral Program for WooCommerce (rewardswp)
- Affected
- from 1.0.2 before 1.6.1
- Remediation
- Update to 1.6.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-17
- Attack surface
- RewardsWP on WPSec AttackSurface
- Fix released
- Published
Description
The RewardsWP plugin for WordPress is vulnerable to Insecure Direct Object Reference via the guest order linking verification in all versions up to, and including, 1.6.0. The verification token is bound only to the user ID and not to the email address it was sent to, and complete_verification() links the guest orders of whatever email the account has when the link is redeemed. This makes it possible for authenticated attackers, with subscriber-level access and above, to receive a verification link for their own address, change their account email to a victim's guest checkout address, and then open the link. The victim's guest orders are then assigned to the attacker's account, exposing the victim's order and billing details.
References
- https://wpsec.com/vuln/WPSEC-2026-1187/
- https://plugins.svn.wordpress.org/rewardswp/tags/1.6.1/
- https://wordpress.org/plugins/rewardswp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS