{
 "id": "WPSEC-2026-2615",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2615/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2615/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2615/index.md",
 "title": "RewardsWP <= 1.7.1 - Unauthenticated Sensitive Information Exposure via Member Display Names",
 "description": "The RewardsWP – Loyalty Points & Referral Program for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure via member account display names in all versions up to, and including, 1.7.1. This is because accounts created through the rewards widget's sign-up and guest-upgrade flows use the member's email address as the username, and the plugin sets only the first and last name. WordPress therefore uses the email address as the account's public display name and nickname. This makes it possible for unauthenticated attackers to collect members' email addresses wherever author names are shown publicly, such as on product reviews and comments those members post.",
 "plugin": {
  "slug": "rewardswp",
  "name": "RewardsWP",
  "full_name": "RewardsWP – Loyalty Points & Referral Program for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/rewardswp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/rewardswp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/rewardswp"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.0",
 "remediation": "Update to 1.8.0 or later.",
 "fix_released": "2026-11-04T19:13:17+00:00",
 "published": "2026-11-05T19:48:59+00:00",
 "updated": "2026-11-05T09:52:47.107756+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2615/",
  "https://plugins.svn.wordpress.org/rewardswp/tags/1.8.0/",
  "https://wordpress.org/plugins/rewardswp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/rewardswp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}