RewardsWP <= 1.7.1 - Unauthenticated Sensitive Information Exposure via Member Display Names
- ID
- WPSEC-2026-2615
- Plugin
- RewardsWP – Loyalty Points & Referral Program for WooCommerce (rewardswp)
- Affected
- all versions before 1.8.0
- Remediation
- Update to 1.8.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- RewardsWP on WPSec AttackSurface
- Fix released
- Published
Description
The RewardsWP – Loyalty Points & Referral Program for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure via member account display names in all versions up to, and including, 1.7.1. This is because accounts created through the rewards widget's sign-up and guest-upgrade flows use the member's email address as the username, and the plugin sets only the first and last name. WordPress therefore uses the email address as the account's public display name and nickname. This makes it possible for unauthenticated attackers to collect members' email addresses wherever author names are shown publicly, such as on product reviews and comments those members post.
References
- https://wpsec.com/vuln/WPSEC-2026-2615/
- https://plugins.svn.wordpress.org/rewardswp/tags/1.8.0/
- https://wordpress.org/plugins/rewardswp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS