CVE-2025-15260

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15260", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-29T14:23:24.297Z", "datePublished": "2026-02-04T08:25:27.589Z", "dateUpdated": "2026-04-08T16:42:27.399Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:27.399Z"}, "affected": [{"vendor": "lwsdevelopers", "product": "MyRewards", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MyRewards \u2013 Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values."}], "title": "MyRewards \u2013 Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2591f473-44ff-4319-8b17-b0f793a29d66?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woorewards/tags/5.6.0/assets/lws-adminpanel/include/internal/editlistcontroler.php#L76"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3458815%40woorewards&new=3458815%40woorewards&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tharadol Suksamran"}], "timeline": [{"time": "2025-12-20T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-03T19:44:15.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T16:18:16.850933Z", "id": "CVE-2025-15260", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:18:24.196Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15260", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T16:18:16.850933Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:18:20.771Z"}}], "cna": {"title": "MyRewards \u2013 Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification", "credits": [{"lang": "en", "type": "finder", "value": "Tharadol Suksamran"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}}], "affected": [{"vendor": "lwsdevelopers", "product": "MyRewards", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.6.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-20T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-03T19:44:15.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2591f473-44ff-4319-8b17-b0f793a29d66?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woorewards/tags/5.6.0/assets/lws-adminpanel/include/internal/editlistcontroler.php#L76"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3458815%40woorewards&new=3458815%40woorewards&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The MyRewards \u2013 Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:27.399Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15260", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:42:27.399Z", "dateReserved": "2025-12-29T14:23:24.297Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-04T08:25:27.589Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MyRewards", "vendor": "lwsdevelopers", "versions": [{"lessThanOrEqual": "5.6.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MyRewards \u2013 Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values."}, {"lang": "es", "value": "El plugin MyRewards \u2013 Loyalty Points y Rewards para WooCommerce para WordPress es vulnerable a la falta de autorizaci\u00f3n en todas las versiones hasta la 5.6.0, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e9 autorizado para realizar una acci\u00f3n en la funci\u00f3n 'ajax'. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, modifiquen, a\u00f1adan o eliminen reglas de obtenci\u00f3n de puntos del programa de fidelizaci\u00f3n, incluyendo la manipulaci\u00f3n de multiplicadores de puntos a valores arbitrarios."}], "id": "CVE-2025-15260", "lastModified": "2026-06-17T08:37:29.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15260", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T16:18:16.850933Z", "version": "2.0.3"}}]}, "published": "2026-02-04T09:15:50.517", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woorewards/tags/5.6.0/assets/lws-adminpanel/include/internal/editlistcontroler.php#L76"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3458815%40woorewards&new=3458815%40woorewards&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2591f473-44ff-4319-8b17-b0f793a29d66?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T15:33:16.152523+00:00", "value": {"mitigation_remediation": ["Update the MyRewards plugin to a version newer than 5.6.1 that includes the authorization fix.", "If an update cannot be applied immediately, restrict Subscriber role from accessing the loyalty rule management UI or through AJAX by removing relevant capabilities or adding role restrictions.", "Audit current loyalty rules and enable detailed logging of rule modifications to detect any unauthorized changes."], "summary": {"action": "Immediate patch", "impact": "Arbitrary modification of loyalty program rules leading to potential financial loss"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the MyRewards Loyalty Points and Rewards plugin version 5.6.1 or earlier is vulnerable. The issue affects the plugin provided by lwsdevelopers, and all deployments using that version in a WooCommerce environment.", "description_and_impact": "The MyRewards plugin for WooCommerce contains a missing authorization flaw in the AJAX handler that allows any authenticated user with Subscriber or higher privileges to modify, add, or delete loyalty program earning rules. Because the plugin fails to verify the user\u2019s rights, attackers can arbitrarily change point multipliers or rule conditions, which could grant them excessive rewards or reduce competitors\u2019 benefits. The vulnerability is a classic Authorization Bypass (CWE\u2011862) and does not grant arbitrary code execution, but it enables significant financial abuse of the loyalty system.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate risk. The EPSS shows less than 1%, suggesting the likelihood of exploitation in this moment is low, and the vulnerability is not listed in CISA KEV. However, once a site is discovered, attackers could exploit the flaw remotely through standard AJAX calls without additional privileges, so the risk is real for sites with exposed APIs. The attack vector is a crafted AJAX request using a Subscriber account or higher, bypassing the missing authorization check."}}}}, "created": "2026-02-04T21:18:23.006390+00:00", "updated": "2026-04-22T15:45:20.868030+00:00", "vendors": ["lwsdevelopers", "lwsdevelopers$PRODUCT$myrewards", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}