Vulnerabilities / RewardsWP
RewardsWP vulnerabilities
Advisories WPSec published for RewardsWP – Loyalty Points & Referral Program for WooCommerce. Other sources may list more. Its attack surface: RewardsWP on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-17 | WPSEC-2026-1187 | RewardsWP <= 1.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Guest Order Takeover via Order Linking Verification | Medium 5.4 | 1.6.1 |
| 2026-10-17 | WPSEC-2026-1186 | RewardsWP <= 1.6.0 - Missing Authorization to Unauthenticated Settings Overwrite via Setup Completion Handler | Medium 5.3 | 1.6.1 |
License: CC BY 4.0