# RewardsWP <= 1.7.1 - Unauthenticated Sensitive Information Exposure via Member Display Names

- **ID:** WPSEC-2026-2615
- **Plugin:** RewardsWP – Loyalty Points & Referral Program for WooCommerce (`rewardswp`), https://wordpress.org/plugins/rewardswp/
- **Affected versions:** all versions before 1.8.0
- **Fixed in:** 1.8.0 (Update to 1.8.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/rewardswp
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2615/

## Description

The RewardsWP – Loyalty Points & Referral Program for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure via member account display names in all versions up to, and including, 1.7.1. This is because accounts created through the rewards widget's sign-up and guest-upgrade flows use the member's email address as the username, and the plugin sets only the first and last name. WordPress therefore uses the email address as the account's public display name and nickname. This makes it possible for unauthenticated attackers to collect members' email addresses wherever author names are shown publicly, such as on product reviews and comments those members post.

## References

- https://wpsec.com/vuln/WPSEC-2026-2615/
- https://plugins.svn.wordpress.org/rewardswp/tags/1.8.0/
- https://wordpress.org/plugins/rewardswp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2615/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.