# RewardsWP <= 1.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Guest Order Takeover via Order Linking Verification

- **ID:** WPSEC-2026-1187
- **Plugin:** RewardsWP – Loyalty Points & Referral Program for WooCommerce (`rewardswp`), https://wordpress.org/plugins/rewardswp/
- **Affected versions:** from 1.0.2 before 1.6.1
- **Fixed in:** 1.6.1 (Update to 1.6.1 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/rewardswp
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1187/

## Description

The RewardsWP plugin for WordPress is vulnerable to Insecure Direct Object Reference via the guest order linking verification in all versions up to, and including, 1.6.0. The verification token is bound only to the user ID and not to the email address it was sent to, and complete_verification() links the guest orders of whatever email the account has when the link is redeemed. This makes it possible for authenticated attackers, with subscriber-level access and above, to receive a verification link for their own address, change their account email to a victim's guest checkout address, and then open the link. The victim's guest orders are then assigned to the attacker's account, exposing the victim's order and billing details.

## References

- https://wpsec.com/vuln/WPSEC-2026-1187/
- https://plugins.svn.wordpress.org/rewardswp/tags/1.6.1/
- https://wordpress.org/plugins/rewardswp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1187/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.