CVE-2026-93510

MediumCVSS 4.3/10Last modified Sep 23, 2026

Description

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-935115.3The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription no CVE-2026-935127.1Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.CVE-2026-935134.3Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.CVE-2026-935147.1Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.CVE-2026-93525.3A weakness has been identified in NousResearch hermes-agent up to 2026.4.23. This issue affects the function _make_run_env of the file tools CVE-2026-935267.1Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.CVE-2026-935278.5Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.CVE-2026-935283.7The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, all CVE-2026-935296.5Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.CVE-2026-93537.3A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.23. Impacted is an unknown function of the file agent/s CVE-2026-935314.3A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects CVE-2026-935326.3A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affe