CVE-2026-93510 — MEDIUM (4.3)

Vulnerability Description

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-862

References

https://wpscan.com/vulnerability/b721d8bb-2426-4635-a419-07074168bd82/

FAQ

What is CVE-2026-93510?

CVE-2026-93510 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Su...

How severe is CVE-2026-93510?

CVE-2026-93510 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-93510?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.